lkml.org 
[lkml]   [2022]   [Oct]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v2] NFS: Avoid memcpy() run-time warning for struct sockaddr overflows
On Sun, Oct 16, 2022 at 09:36:50PM -0700, Kees Cook wrote:
> The 'nfs_server' and 'mount_server' structures include a union of
> 'struct sockaddr' (with the older 16 bytes max address size) and
> 'struct sockaddr_storage' which is large enough to hold all the
> supported sa_family types (128 bytes max size). The runtime memcpy()
> buffer overflow checker is seeing attempts to write beyond the 16
> bytes as an overflow, but the actual expected size is that of 'struct
> sockaddr_storage'. Plumb the use of 'struct sockaddr_storage' more
> completely through-out NFS, which results in adjusting the memcpy()
> buffers to the correct union members. Avoids this false positive run-time
> warning under CONFIG_FORTIFY_SOURCE:
>
> memcpy: detected field-spanning write (size 28) of single field "&ctx->nfs_server.address" at fs/nfs/namespace.c:178 (size 16)
>
> Reported-by: kernel test robot <yujie.liu@intel.com>
> Link: https://lore.kernel.org/all/202210110948.26b43120-yujie.liu@intel.com
> Cc: Trond Myklebust <trond.myklebust@hammerspace.com>
> Cc: Anna Schumaker <anna@kernel.org>

Friendly ping -- this needs to land in v6.1 to avoid these warnings.
Should I carry this in the hardening tree instead?

Thanks!

-Kees

--
Kees Cook

\
 
 \ /
  Last update: 2022-10-27 01:33    [W:0.074 / U:0.460 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site