From faf37b51e7e5758efe33bae6a5c3324606431244 Mon Sep 17 00:00:00 2001 From: Benjamin Lamowski Date: Mon, 23 Jan 2023 19:16:00 +0100 Subject: [PATCH] dde_linux: backport fix for use-after-free reported by GCC 12 On my system, compiling dde_linux fails with `-Werror=use-after-free`. Backport the fix from mainline to get rid of the issue. Fixes #4740 --- .../patches/realloc-fix-gcc-12.patch | 66 +++++++++++++++++++ repos/dde_linux/ports/linux.hash | 2 +- repos/dde_linux/ports/linux.port | 3 +- 3 files changed, 69 insertions(+), 2 deletions(-) create mode 100644 repos/dde_linux/patches/realloc-fix-gcc-12.patch diff --git a/repos/dde_linux/patches/realloc-fix-gcc-12.patch b/repos/dde_linux/patches/realloc-fix-gcc-12.patch new file mode 100644 index 0000000000..cd36028c23 --- /dev/null +++ b/repos/dde_linux/patches/realloc-fix-gcc-12.patch @@ -0,0 +1,66 @@ +From 52a9dab6d892763b2a8334a568bd4e2c1a6fde66 Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Sun, 13 Feb 2022 10:24:43 -0800 +Subject: [PATCH] libsubcmd: Fix use-after-free for realloc(..., 0) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +GCC 12 correctly reports a potential use-after-free condition in the +xrealloc helper. Fix the warning by avoiding an implicit "free(ptr)" +when size == 0: + +In file included from help.c:12: +In function 'xrealloc', + inlined from 'add_cmdname' at help.c:24:2: subcmd-util.h:56:23: error: pointer may be used after 'realloc' [-Werror=use-after-free] + 56 | ret = realloc(ptr, size); + | ^~~~~~~~~~~~~~~~~~ +subcmd-util.h:52:21: note: call to 'realloc' here + 52 | void *ret = realloc(ptr, size); + | ^~~~~~~~~~~~~~~~~~ +subcmd-util.h:58:31: error: pointer may be used after 'realloc' [-Werror=use-after-free] + 58 | ret = realloc(ptr, 1); + | ^~~~~~~~~~~~~~~ +subcmd-util.h:52:21: note: call to 'realloc' here + 52 | void *ret = realloc(ptr, size); + | ^~~~~~~~~~~~~~~~~~ + +Fixes: 2f4ce5ec1d447beb ("perf tools: Finalize subcmd independence") +Reported-by: Valdis Klētnieks +Signed-off-by: Kees Kook +Tested-by: Valdis Klētnieks +Tested-by: Justin M. Forbes +Acked-by: Josh Poimboeuf +Cc: linux-hardening@vger.kernel.org +Cc: Valdis Klētnieks +Link: http://lore.kernel.org/lkml/20220213182443.4037039-1-keescook@chromium.org +Signed-off-by: Arnaldo Carvalho de Melo +--- + tools/lib/subcmd/subcmd-util.h | 11 ++--------- + 1 file changed, 2 insertions(+), 9 deletions(-) + +diff --git a/tools/lib/subcmd/subcmd-util.h b/tools/lib/subcmd/subcmd-util.h +index 794a375dad36..b2aec04fce8f 100644 +--- src/linux/tools/lib/subcmd/subcmd-util.h ++++ src/linux/tools/lib/subcmd/subcmd-util.h +@@ -50,15 +50,8 @@ static NORETURN inline void die(const char *err, ...) + static inline void *xrealloc(void *ptr, size_t size) + { + void *ret = realloc(ptr, size); +- if (!ret && !size) +- ret = realloc(ptr, 1); +- if (!ret) { +- ret = realloc(ptr, size); +- if (!ret && !size) +- ret = realloc(ptr, 1); +- if (!ret) +- die("Out of memory, realloc failed"); +- } ++ if (!ret) ++ die("Out of memory, realloc failed"); + return ret; + } + +-- +2.39.0 + diff --git a/repos/dde_linux/ports/linux.hash b/repos/dde_linux/ports/linux.hash index c514d17c2d..b9daa17cd4 100644 --- a/repos/dde_linux/ports/linux.hash +++ b/repos/dde_linux/ports/linux.hash @@ -1 +1 @@ -dccfc6e02b4f279be801444242ba5ee37e9b8082 +e6468ebf5e274f248bf6c8362fe6b59107ff7122 diff --git a/repos/dde_linux/ports/linux.port b/repos/dde_linux/ports/linux.port index 9815d7a7bb..cfa8253995 100644 --- a/repos/dde_linux/ports/linux.port +++ b/repos/dde_linux/ports/linux.port @@ -10,7 +10,8 @@ DIR(linux) := src/linux # Patches # PATCH_FILES := i915_irq.patch i915_alderlake.patch xhci_fix_event_37.patch \ - xhci_abort_ring.patch iwlwifi_enable_irq_before_pnvm.patch + xhci_abort_ring.patch iwlwifi_enable_irq_before_pnvm.patch \ + realloc-fix-gcc-12.patch PATCHES += $(addprefix patches/,$(PATCH_FILES)) # i915