lkml.org 
[lkml]   [2022]   [Sep]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 095/148] wireguard: netlink: avoid variable-sized memcpy on sockaddr
    Date
    From: Jason A. Donenfeld <Jason@zx2c4.com>

    [ Upstream commit 26c013108c12b94bc023bf19198a4300596c98b1 ]

    Doing a variable-sized memcpy is slower, and the compiler isn't smart
    enough to turn this into a constant-size assignment.

    Further, Kees' latest fortified memcpy will actually bark, because the
    destination pointer is type sockaddr, not explicitly sockaddr_in or
    sockaddr_in6, so it thinks there's an overflow:

    memcpy: detected field-spanning write (size 28) of single field
    "&endpoint.addr" at drivers/net/wireguard/netlink.c:446 (size 16)

    Fix this by just assigning by using explicit casts for each checked
    case.

    Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
    Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
    Reviewed-by: Kees Cook <keescook@chromium.org>
    Reported-by: syzbot+a448cda4dba2dac50de5@syzkaller.appspotmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireguard/netlink.c | 13 ++++++-------
    1 file changed, 6 insertions(+), 7 deletions(-)

    diff --git a/drivers/net/wireguard/netlink.c b/drivers/net/wireguard/netlink.c
    index d0f3b6d7f408..5c804bcabfe6 100644
    --- a/drivers/net/wireguard/netlink.c
    +++ b/drivers/net/wireguard/netlink.c
    @@ -436,14 +436,13 @@ static int set_peer(struct wg_device *wg, struct nlattr **attrs)
    if (attrs[WGPEER_A_ENDPOINT]) {
    struct sockaddr *addr = nla_data(attrs[WGPEER_A_ENDPOINT]);
    size_t len = nla_len(attrs[WGPEER_A_ENDPOINT]);
    + struct endpoint endpoint = { { { 0 } } };

    - if ((len == sizeof(struct sockaddr_in) &&
    - addr->sa_family == AF_INET) ||
    - (len == sizeof(struct sockaddr_in6) &&
    - addr->sa_family == AF_INET6)) {
    - struct endpoint endpoint = { { { 0 } } };
    -
    - memcpy(&endpoint.addr, addr, len);
    + if (len == sizeof(struct sockaddr_in) && addr->sa_family == AF_INET) {
    + endpoint.addr4 = *(struct sockaddr_in *)addr;
    + wg_socket_set_peer_endpoint(peer, &endpoint);
    + } else if (len == sizeof(struct sockaddr_in6) && addr->sa_family == AF_INET6) {
    + endpoint.addr6 = *(struct sockaddr_in6 *)addr;
    wg_socket_set_peer_endpoint(peer, &endpoint);
    }
    }
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-09-26 13:21    [W:4.061 / U:0.100 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site