In the Linux kernel, the following vulnerability has been resolved: clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access Flexible-array member hws
in struct clk_hw_onecell_data
is annotated with the counted_by()
attribute. This means that when memory is allocated for this array, the counter, which in this case is member num
in the flexible structure, should be set to the maximum number of elements the flexible array can contain, or fewer. In this case, the total number of elements for the flexible array is determined by variable clks_num
when allocating heap space via devm_kzalloc()
, as shown below: 289 struct loongson2clkprovider *clp; ... 296 for (p = data; p->name; p++) 297 clksnum++; 298 299 clp = devmkzalloc(dev, structsize(clp, clkdata.hws, clksnum), 300 GFPKERNEL); So, clp->clk_data.num
should be set to clks_num
or less, and not exceed clks_num
, as is currently the case. Otherwise, if data is written into clp->clk_data.hws[clks_num]
, the instrumentation provided by the compiler won't detect the overflow, leading to a memory corruption bug at runtime. Fix this issue by setting clp->clk_data.num
to clks_num
.
{ "availability": "No subscription required", "binaries": [ { "binary_name": "linux-buildinfo-6.11.0-1015-oem", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-headers-6.11.0-1015-oem", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-oem", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-oem-dbgsym", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-modules-6.11.0-1015-oem", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-modules-ipu6-6.11.0-1015-oem", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-modules-ipu7-6.11.0-1015-oem", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-modules-iwlwifi-6.11.0-1015-oem", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-modules-usbio-6.11.0-1015-oem", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-modules-vision-6.11.0-1015-oem", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-oem-6.11-headers-6.11.0-1015", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-oem-6.11-tools-6.11.0-1015", "binary_version": "6.11.0-1015.15" }, { "binary_name": "linux-tools-6.11.0-1015-oem", "binary_version": "6.11.0-1015.15" } ] }