lkml.org 
[lkml]   [2021]   [Jul]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 62/64] netlink: Avoid false-positive memcpy() warning
    Date
    In preparation for FORTIFY_SOURCE performing compile-time and run-time
    field bounds checking for memcpy(), memmove(), and memset(), avoid
    intentionally writing across neighboring fields.

    Add a flexible array member to mark the end of struct nlmsghdr, and
    split the memcpy() to avoid false positive memcpy() warning:

    memcpy: detected field-spanning write (size 32) of single field (size 16)

    Signed-off-by: Kees Cook <keescook@chromium.org>
    ---
    include/uapi/linux/netlink.h | 1 +
    net/netlink/af_netlink.c | 4 +++-
    2 files changed, 4 insertions(+), 1 deletion(-)

    diff --git a/include/uapi/linux/netlink.h b/include/uapi/linux/netlink.h
    index 4c0cde075c27..ddeaa748df5e 100644
    --- a/include/uapi/linux/netlink.h
    +++ b/include/uapi/linux/netlink.h
    @@ -47,6 +47,7 @@ struct nlmsghdr {
    __u16 nlmsg_flags; /* Additional flags */
    __u32 nlmsg_seq; /* Sequence number */
    __u32 nlmsg_pid; /* Sending process port ID */
    + __u8 contents[];
    };

    /* Flags values */
    diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
    index 24b7cf447bc5..f2dd99e96822 100644
    --- a/net/netlink/af_netlink.c
    +++ b/net/netlink/af_netlink.c
    @@ -2447,7 +2447,9 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,
    NLMSG_ERROR, payload, flags);
    errmsg = nlmsg_data(rep);
    errmsg->error = err;
    - memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg) ? nlh->nlmsg_len : sizeof(*nlh));
    + memcpy(&errmsg->msg, nlh, sizeof(*nlh));
    + if (payload > sizeof(*errmsg))
    + memcpy(errmsg->msg.contents, nlh->contents, nlh->nlmsg_len - sizeof(*nlh));

    if (nlk_has_extack && extack) {
    if (extack->_msg) {
    --
    2.30.2
    \
     
     \ /
      Last update: 2021-07-27 23:20    [W:3.965 / U:0.252 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site