Skip to contentSkip to conversation

fortify: Fix incorrect reporting of read buffer size

PATCH In review Kees Cook 2 participants 2 messages Jul 29, 2025 FORTIFY_SOURCE

lore
Share & tools
lore

Kees Cook

author maintainer
#0 lore raw

PATCH 1/1 fortify: Fix incorrect reporting of read buffer size

When FORTIFY_SOURCE reports about a run-time buffer overread, the wrong buffer size was being shown in the error message. (The bounds checking was correct.)

Fixes 3d965b33e40d ("fortify: Improve buffer overflow reporting")
Signed-off-by Kees Cook <[email protected]>

---
Cc: <[email protected]>

---
 include/linux/fortify-string.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/fortify-string.h +1 -1
index e4ce1cae03bf..b3b53f8c1b28 100644
@@ -596,7 +596,7 @@ __FORTIFY_INLINE bool fortify_memcpy_chk(__kernel_size_t size,
 	if (p_size != SIZE_MAX && p_size < size)
 		fortify_panic(func, FORTIFY_WRITE, p_size, size, true);
 	else if (q_size != SIZE_MAX && q_size < size)
-		fortify_panic(func, FORTIFY_READ, p_size, size, true);
+		fortify_panic(func, FORTIFY_READ, q_size, size, true);
 
 	/*
 	 * Warn when writing beyond destination field size.
Signature · 1 line
2.34.1
Reviewed-by on v1 1/1
#1 lore raw
Quoted 6 lines · Kees Cook

When FORTIFY_SOURCE reports about a run-time buffer overread, the wrong buffer size was being shown in the error message. (The bounds checking was correct.)

Fixes 3d965b33e40d ("fortify: Improve buffer overflow reporting")
Signed-off-by Kees Cook <[email protected]>
Reviewed-by Gustavo A. R. Silva <[email protected]>

Thanks!
-Gustavo

Quoted 19 lines

---
Cc: <[email protected]>

---
  include/linux/fortify-string.h | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/fortify-string.h +1 -1
index e4ce1cae03bf..b3b53f8c1b28 100644
@@ -596,7 +596,7 @@ __FORTIFY_INLINE bool fortify_memcpy_chk(__kernel_size_t size,
  	if (p_size != SIZE_MAX && p_size < size)
  		fortify_panic(func, FORTIFY_WRITE, p_size, size, true);
  	else if (q_size != SIZE_MAX && q_size < size)
-		fortify_panic(func, FORTIFY_READ, p_size, size, true);
+		fortify_panic(func, FORTIFY_READ, q_size, size, true);
 
  	/*
  	 * Warn when writing beyond destination field size.