lkml.org 
[lkml]   [2021]   [Jul]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 44/64] iw_cxgb4: Use memset_after() for cpl_t5_pass_accept_rpl
    Date
    In preparation for FORTIFY_SOURCE performing compile-time and run-time
    field bounds checking for memset(), avoid intentionally writing across
    neighboring fields.

    Use memset_after() so memset() doesn't get confused about writing
    beyond the destination member that is intended to be the starting point
    of zeroing through the end of the struct. Additionally, since everything
    appears to perform a roundup (including allocation), just change the
    size of the struct itself and add a build-time check to validate the
    expected size.

    Signed-off-by: Kees Cook <keescook@chromium.org>
    ---
    drivers/infiniband/hw/cxgb4/cm.c | 5 +++--
    drivers/net/ethernet/chelsio/cxgb4/t4_msg.h | 2 +-
    2 files changed, 4 insertions(+), 3 deletions(-)

    diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
    index 291471d12197..7129ae025b2d 100644
    --- a/drivers/infiniband/hw/cxgb4/cm.c
    +++ b/drivers/infiniband/hw/cxgb4/cm.c
    @@ -2471,7 +2471,8 @@ static int accept_cr(struct c4iw_ep *ep, struct sk_buff *skb,
    skb_get(skb);
    rpl = cplhdr(skb);
    if (!is_t4(adapter_type)) {
    - skb_trim(skb, roundup(sizeof(*rpl5), 16));
    + BUILD_BUG_ON(sizeof(*rpl5) != roundup(sizeof(*rpl5), 16));
    + skb_trim(skb, sizeof(*rpl5));
    rpl5 = (void *)rpl;
    INIT_TP_WR(rpl5, ep->hwtid);
    } else {
    @@ -2487,7 +2488,7 @@ static int accept_cr(struct c4iw_ep *ep, struct sk_buff *skb,
    opt2 |= CONG_CNTRL_V(CONG_ALG_TAHOE);
    opt2 |= T5_ISS_F;
    rpl5 = (void *)rpl;
    - memset(&rpl5->iss, 0, roundup(sizeof(*rpl5)-sizeof(*rpl), 16));
    + memset_after(rpl5, 0, opt0);
    if (peer2peer)
    isn += 4;
    rpl5->iss = cpu_to_be32(isn);
    diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_msg.h b/drivers/net/ethernet/chelsio/cxgb4/t4_msg.h
    index fed5f93bf620..26433a62d7f0 100644
    --- a/drivers/net/ethernet/chelsio/cxgb4/t4_msg.h
    +++ b/drivers/net/ethernet/chelsio/cxgb4/t4_msg.h
    @@ -497,7 +497,7 @@ struct cpl_t5_pass_accept_rpl {
    __be32 opt2;
    __be64 opt0;
    __be32 iss;
    - __be32 rsvd;
    + __be32 rsvd[3];
    };

    struct cpl_act_open_req {
    --
    2.30.2
    \
     
     \ /
      Last update: 2021-07-27 23:07    [W:2.076 / U:0.096 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site