lkml.org 
[lkml]   [2021]   [Aug]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v2 16/63] cxgb4: Use struct_group() for memcpy() region
    Date
    In preparation for FORTIFY_SOURCE performing compile-time and run-time
    field bounds checking for memcpy(), memmove(), and memset(), avoid
    intentionally writing across neighboring fields.

    Use struct_group() in struct fw_eth_tx_pkt_vm_wr around members ethmacdst,
    ethmacsrc, ethtype, and vlantci, so they can be referenced together. This
    will allow memcpy() and sizeof() to more easily reason about sizes,
    improve readability, and avoid future warnings about writing beyond the
    end of ethmacdst.

    "pahole" shows no size nor member offset changes to struct
    fw_eth_tx_pkt_vm_wr. "objdump -d" shows no object code changes.

    Cc: Raju Rangoju <rajur@chelsio.com>
    Cc: "David S. Miller" <davem@davemloft.net>
    Cc: Jakub Kicinski <kuba@kernel.org>
    Cc: netdev@vger.kernel.org
    Signed-off-by: Kees Cook <keescook@chromium.org>
    ---
    drivers/net/ethernet/chelsio/cxgb4/sge.c | 8 +++++---
    drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h | 10 ++++++----
    drivers/net/ethernet/chelsio/cxgb4vf/sge.c | 7 ++-----
    3 files changed, 13 insertions(+), 12 deletions(-)

    diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
    index 6a099cb34b12..9080b2c5ffe8 100644
    --- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
    +++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
    @@ -1842,8 +1842,10 @@ static netdev_tx_t cxgb4_vf_eth_xmit(struct sk_buff *skb,
    * (including the VLAN tag) into the header so we reject anything
    * smaller than that ...
    */
    - fw_hdr_copy_len = sizeof(wr->ethmacdst) + sizeof(wr->ethmacsrc) +
    - sizeof(wr->ethtype) + sizeof(wr->vlantci);
    + BUILD_BUG_ON(sizeof(wr->firmware) !=
    + (sizeof(wr->ethmacdst) + sizeof(wr->ethmacsrc) +
    + sizeof(wr->ethtype) + sizeof(wr->vlantci)));
    + fw_hdr_copy_len = sizeof(wr->firmware);
    ret = cxgb4_validate_skb(skb, dev, fw_hdr_copy_len);
    if (ret)
    goto out_free;
    @@ -1924,7 +1926,7 @@ static netdev_tx_t cxgb4_vf_eth_xmit(struct sk_buff *skb,
    wr->equiq_to_len16 = cpu_to_be32(wr_mid);
    wr->r3[0] = cpu_to_be32(0);
    wr->r3[1] = cpu_to_be32(0);
    - skb_copy_from_linear_data(skb, (void *)wr->ethmacdst, fw_hdr_copy_len);
    + skb_copy_from_linear_data(skb, &wr->firmware, fw_hdr_copy_len);
    end = (u64 *)wr + flits;

    /* If this is a Large Send Offload packet we'll put in an LSO CPL
    diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h b/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
    index 0a326c054707..2419459a0b85 100644
    --- a/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
    +++ b/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
    @@ -794,10 +794,12 @@ struct fw_eth_tx_pkt_vm_wr {
    __be32 op_immdlen;
    __be32 equiq_to_len16;
    __be32 r3[2];
    - u8 ethmacdst[6];
    - u8 ethmacsrc[6];
    - __be16 ethtype;
    - __be16 vlantci;
    + struct_group(firmware,
    + u8 ethmacdst[ETH_ALEN];
    + u8 ethmacsrc[ETH_ALEN];
    + __be16 ethtype;
    + __be16 vlantci;
    + );
    };

    #define FW_CMD_MAX_TIMEOUT 10000
    diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
    index 7bc80eeb2c21..671ca93e64ab 100644
    --- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
    +++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
    @@ -1167,10 +1167,7 @@ netdev_tx_t t4vf_eth_xmit(struct sk_buff *skb, struct net_device *dev)
    struct cpl_tx_pkt_core *cpl;
    const struct skb_shared_info *ssi;
    dma_addr_t addr[MAX_SKB_FRAGS + 1];
    - const size_t fw_hdr_copy_len = (sizeof(wr->ethmacdst) +
    - sizeof(wr->ethmacsrc) +
    - sizeof(wr->ethtype) +
    - sizeof(wr->vlantci));
    + const size_t fw_hdr_copy_len = sizeof(wr->firmware);

    /*
    * The chip minimum packet length is 10 octets but the firmware
    @@ -1267,7 +1264,7 @@ netdev_tx_t t4vf_eth_xmit(struct sk_buff *skb, struct net_device *dev)
    wr->equiq_to_len16 = cpu_to_be32(wr_mid);
    wr->r3[0] = cpu_to_be32(0);
    wr->r3[1] = cpu_to_be32(0);
    - skb_copy_from_linear_data(skb, (void *)wr->ethmacdst, fw_hdr_copy_len);
    + skb_copy_from_linear_data(skb, &wr->firmware, fw_hdr_copy_len);
    end = (u64 *)wr + flits;

    /*
    --
    2.30.2
    \
     
     \ /
      Last update: 2021-08-18 08:20    [W:4.279 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site