From: Kees Cook <keescook@chromium.org>
To: "Gustavo A . R . Silva" <gustavoars@kernel.org>
Cc: "Kees Cook" <keescook@chromium.org>,
"Rasmus Villemoes" <linux@rasmusvillemoes.dk>,
"David S. Miller" <davem@davemloft.net>,
"Jakub Kicinski" <kuba@kernel.org>,
"Rich Felker" <dalias@aerifal.cx>,
"Eric Dumazet" <edumazet@google.com>,
netdev@vger.kernel.org, "Alexei Starovoitov" <ast@kernel.org>,
alsa-devel@alsa-project.org, "Al Viro" <viro@zeniv.linux.org.uk>,
"Andrew Gabbasov" <andrew_gabbasov@mentor.com>,
"Andrew Morton" <akpm@linux-foundation.org>,
"Andy Gross" <agross@kernel.org>,
"Andy Lavr" <andy.lavr@gmail.com>,
"Arend van Spriel" <aspriel@gmail.com>,
"Baowen Zheng" <baowen.zheng@corigine.com>,
"Bjorn Andersson" <bjorn.andersson@linaro.org>,
"Boris Ostrovsky" <boris.ostrovsky@oracle.com>,
"Bradley Grove" <linuxdrivers@attotech.com>,
brcm80211-dev-list.pdl@broadcom.com,
"Christian Brauner" <brauner@kernel.org>,
"Christian Göttsche" <cgzones@googlemail.com>,
"Christian Lamparter" <chunkeey@googlemail.com>,
"Chris Zankel" <chris@zankel.net>,
"Cong Wang" <cong.wang@bytedance.com>,
"Daniel Axtens" <dja@axtens.net>,
"Daniel Vetter" <daniel.vetter@ffwll.ch>,
"Dan Williams" <dan.j.williams@intel.com>,
"David Gow" <davidgow@google.com>,
"David Howells" <dhowells@redhat.com>,
"Dennis Dalessandro" <dennis.dalessandro@cornelisnetworks.com>,
devicetree@vger.kernel.org, "Dexuan Cui" <decui@microsoft.com>,
"Dmitry Kasatkin" <dmitry.kasatkin@gmail.com>,
"Eli Cohen" <elic@nvidia.com>,
"Eric Paris" <eparis@parisplace.org>,
"Eugeniu Rosca" <erosca@de.adit-jv.com>,
"Felipe Balbi" <balbi@kernel.org>,
"Francis Laniel" <laniel_francis@privacyrequired.com>,
"Frank Rowand" <frowand.list@gmail.com>,
"Franky Lin" <franky.lin@broadcom.com>,
"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
"Gregory Greenman" <gregory.greenman@intel.com>,
"Guenter Roeck" <linux@roeck-us.net>,
"Haiyang Zhang" <haiyangz@microsoft.com>,
"Hante Meuleman" <hante.meuleman@broadcom.com>,
"Herbert Xu" <herbert@gondor.apana.org.au>,
"Hulk Robot" <hulkci@huawei.com>,
"James E.J. Bottomley" <jejb@linux.ibm.com>,
"James Morris" <jmorris@namei.org>,
"Jarkko Sakkinen" <jarkko@kernel.org>,
"Jaroslav Kysela" <perex@perex.cz>,
"Jason Gunthorpe" <jgg@ziepe.ca>, "Jens Axboe" <axboe@kernel.dk>,
"Johan Hedberg" <johan.hedberg@gmail.com>,
"Johannes Berg" <johannes.berg@intel.com>,
"Johannes Berg" <johannes@sipsolutions.net>,
"John Keeping" <john@metanate.com>,
"Juergen Gross" <jgross@suse.com>,
"Kalle Valo" <kvalo@kernel.org>,
"Keith Packard" <keithp@keithp.com>,
keyrings@vger.kernel.org, kunit-dev@googlegroups.com,
"Kuniyuki Iwashima" <kuniyu@amazon.co.jp>,
"K. Y. Srinivasan" <kys@microsoft.com>,
"Lars-Peter Clausen" <lars@metafoo.de>,
"Lee Jones" <lee.jones@linaro.org>,
"Leon Romanovsky" <leon@kernel.org>,
"Liam Girdwood" <lgirdwood@gmail.com>,
linux1394-devel@lists.sourceforge.net,
linux-afs@lists.infradead.org,
linux-arm-kernel@lists.infradead.org,
linux-arm-msm@vger.kernel.org, linux-bluetooth@vger.kernel.org,
linux-hardening@vger.kernel.org, linux-hyperv@vger.kernel.org,
linux-integrity@vger.kernel.org, linux-rdma@vger.kernel.org,
linux-scsi@vger.kernel.org,
linux-security-module@vger.kernel.org, linux-usb@vger.kernel.org,
linux-wireless@vger.kernel.org, linux-xtensa@linux-xtensa.org,
llvm@lists.linux.dev, "Loic Poulain" <loic.poulain@linaro.org>,
"Louis Peens" <louis.peens@corigine.com>,
"Luca Coelho" <luciano.coelho@intel.com>,
"Luiz Augusto von Dentz" <luiz.dentz@gmail.com>,
"Marc Dionne" <marc.dionne@auristor.com>,
"Marcel Holtmann" <marcel@holtmann.org>,
"Mark Brown" <broonie@kernel.org>,
"Martin K. Petersen" <martin.petersen@oracle.com>,
"Max Filippov" <jcmvbkbc@gmail.com>,
"Mimi Zohar" <zohar@linux.ibm.com>,
"Muchun Song" <songmuchun@bytedance.com>,
"Nathan Chancellor" <nathan@kernel.org>,
"Nick Desaulniers" <ndesaulniers@google.com>,
"Nuno Sá" <nuno.sa@analog.com>, "Paolo Abeni" <pabeni@redhat.com>,
"Paul Moore" <paul@paul-moore.com>,
"Rob Herring" <robh+dt@kernel.org>,
"Russell King" <linux@armlinux.org.uk>,
selinux@vger.kernel.org, "Serge E. Hallyn" <serge@hallyn.com>,
SHA-cyfmac-dev-list@infineon.com,
"Simon Horman" <simon.horman@corigine.com>,
"Stefano Stabellini" <sstabellini@kernel.org>,
"Stefan Richter" <stefanr@s5r6.in-berlin.de>,
"Steffen Klassert" <steffen.klassert@secunet.com>,
"Stephen Hemminger" <sthemmin@microsoft.com>,
"Stephen Smalley" <stephen.smalley.work@gmail.com>,
"Tadeusz Struk" <tadeusz.struk@linaro.org>,
"Takashi Iwai" <tiwai@suse.com>, "Tom Rix" <trix@redhat.com>,
"Udipto Goswami" <quic_ugoswami@quicinc.com>,
"Vincenzo Frascino" <vincenzo.frascino@arm.com>,
wcn36xx@lists.infradead.org, "Wei Liu" <wei.liu@kernel.org>,
xen-devel@lists.xenproject.org,
"Xiu Jianfeng" <xiujianfeng@huawei.com>,
"Yang Yingliang" <yangyingliang@huawei.com>
Subject: [PATCH 01/32] netlink: Avoid memcpy() across flexible array boundary
Date: Tue, 3 May 2022 18:44:10 -0700 [thread overview]
Message-ID: <20220504014440.3697851-2-keescook@chromium.org> (raw)
In-Reply-To: <20220504014440.3697851-1-keescook@chromium.org>
In preparation for run-time memcpy() bounds checking, split the nlmsg
copying for error messages (which crosses a previous unspecified flexible
array boundary) in half. Avoids the future run-time warning:
memcpy: detected field-spanning write (size 32) of single field "&errmsg->msg" (size 16)
Creates an explicit flexible array at the end of nlmsghdr for the payload,
named "nlmsg_payload". There is no impact on UAPI; the sizeof(struct
nlmsghdr) does not change, but now the compiler can better reason about
where things are being copied.
Fixed-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Link: https://lore.kernel.org/lkml/d7251d92-150b-5346-6237-52afc154bb00@rasmusvillemoes.dk
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Rich Felker <dalias@aerifal.cx>
Cc: Eric Dumazet <edumazet@google.com>
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
---
include/uapi/linux/netlink.h | 1 +
net/netlink/af_netlink.c | 5 ++++-
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/include/uapi/linux/netlink.h b/include/uapi/linux/netlink.h
index 855dffb4c1c3..47f9342d51bc 100644
--- a/include/uapi/linux/netlink.h
+++ b/include/uapi/linux/netlink.h
@@ -47,6 +47,7 @@ struct nlmsghdr {
__u16 nlmsg_flags; /* Additional flags */
__u32 nlmsg_seq; /* Sequence number */
__u32 nlmsg_pid; /* Sending process port ID */
+ __u8 nlmsg_payload[];/* Contents of message */
};
/* Flags values */
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 1b5a9c2e1c29..09346aee1022 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2445,7 +2445,10 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,
NLMSG_ERROR, payload, flags);
errmsg = nlmsg_data(rep);
errmsg->error = err;
- memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg) ? nlh->nlmsg_len : sizeof(*nlh));
+ errmsg->msg = *nlh;
+ if (payload > sizeof(*errmsg))
+ memcpy(errmsg->msg.nlmsg_payload, nlh->nlmsg_payload,
+ nlh->nlmsg_len - sizeof(*nlh));
if (nlk_has_extack && extack) {
if (extack->_msg) {
--
2.32.0
next prev parent reply other threads:[~2022-05-04 1:47 UTC|newest]
Thread overview: 63+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-05-04 1:44 [PATCH 00/32] Introduce flexible array struct memcpy() helpers Kees Cook
2022-05-04 1:44 ` Kees Cook [this message]
2022-05-04 3:31 ` [PATCH 01/32] netlink: Avoid memcpy() across flexible array boundary Gustavo A. R. Silva
2022-05-04 3:37 ` Kees Cook
2022-05-04 1:44 ` [PATCH 02/32] Introduce flexible array struct memcpy() helpers Kees Cook
2022-05-04 7:25 ` Johannes Berg
2022-05-04 15:38 ` Kees Cook
2022-05-04 16:08 ` David Laight
2022-05-05 13:16 ` Johannes Berg
2022-05-05 15:16 ` Keith Packard
2022-05-05 19:32 ` Kees Cook
2022-05-05 20:08 ` Keith Packard
2022-05-05 20:12 ` Johannes Berg
2022-05-06 11:15 ` David Laight
2022-05-05 19:27 ` Kees Cook
2022-05-04 1:44 ` [PATCH 03/32] flex_array: Add Kunit tests Kees Cook
2022-05-04 3:00 ` David Gow
2022-05-04 19:43 ` Kees Cook
2022-05-04 19:58 ` Daniel Latypov
2022-05-04 1:44 ` [PATCH 04/32] fortify: Add run-time WARN for cross-field memcpy() Kees Cook
2022-05-04 1:44 ` [PATCH 05/32] brcmfmac: Use mem_to_flex_dup() with struct brcmf_fweh_queue_item Kees Cook
2022-05-04 1:44 ` [PATCH 06/32] iwlwifi: calib: Prepare to use mem_to_flex_dup() Kees Cook
2022-05-04 1:44 ` [PATCH 07/32] iwlwifi: calib: Use mem_to_flex_dup() with struct iwl_calib_result Kees Cook
2022-05-04 1:44 ` [PATCH 08/32] iwlwifi: mvm: Use mem_to_flex_dup() with struct ieee80211_key_conf Kees Cook
2022-05-04 1:44 ` [PATCH 09/32] p54: Use mem_to_flex_dup() with struct p54_cal_database Kees Cook
2022-05-04 1:44 ` [PATCH 10/32] wcn36xx: Use mem_to_flex_dup() with struct wcn36xx_hal_ind_msg Kees Cook
2022-05-04 5:42 ` Kalle Valo
2022-05-04 15:08 ` Kees Cook
2022-05-04 1:44 ` [PATCH 11/32] nl80211: Use mem_to_flex_dup() with struct cfg80211_cqm_config Kees Cook
2022-05-04 1:44 ` [PATCH 12/32] cfg80211: Use mem_to_flex_dup() with struct cfg80211_bss_ies Kees Cook
2022-05-04 7:28 ` Johannes Berg
2022-05-04 15:13 ` Kees Cook
2022-05-04 1:44 ` [PATCH 13/32] mac80211: Use mem_to_flex_dup() with several structs Kees Cook
2022-05-04 1:44 ` [PATCH 14/32] af_unix: Use mem_to_flex_dup() with struct unix_address Kees Cook
2022-05-04 1:44 ` [PATCH 15/32] 802/garp: Use mem_to_flex_dup() with struct garp_attr Kees Cook
2022-05-04 1:44 ` [PATCH 16/32] 802/mrp: Use mem_to_flex_dup() with struct mrp_attr Kees Cook
2022-05-04 1:44 ` [PATCH 17/32] net/flow_offload: Use mem_to_flex_dup() with struct flow_action_cookie Kees Cook
2022-05-04 1:44 ` [PATCH 18/32] firewire: Use __mem_to_flex_dup() with struct iso_interrupt_event Kees Cook
2022-05-04 1:44 ` [PATCH 19/32] afs: Use mem_to_flex_dup() with struct afs_acl Kees Cook
2022-05-04 1:44 ` [PATCH 20/32] ASoC: sigmadsp: Use mem_to_flex_dup() with struct sigmadsp_data Kees Cook
2022-05-04 15:17 ` Mark Brown
2022-05-04 1:44 ` [PATCH 21/32] soc: qcom: apr: Use mem_to_flex_dup() with struct apr_rx_buf Kees Cook
2022-05-04 1:44 ` [PATCH 22/32] atags_proc: Use mem_to_flex_dup() with struct buffer Kees Cook
2022-05-04 1:44 ` [PATCH 23/32] Bluetooth: Use mem_to_flex_dup() with struct hci_op_configure_data_path Kees Cook
2022-05-04 1:44 ` [PATCH 24/32] IB/hfi1: Use mem_to_flex_dup() for struct tid_rb_node Kees Cook
2022-05-04 1:44 ` [PATCH 25/32] Drivers: hv: utils: Use mem_to_flex_dup() with struct cn_msg Kees Cook
2022-05-04 1:44 ` [PATCH 26/32] ima: Use mem_to_flex_dup() with struct modsig Kees Cook
2022-05-04 1:44 ` [PATCH 27/32] KEYS: Use mem_to_flex_dup() with struct user_key_payload Kees Cook
2022-05-04 1:44 ` [PATCH 28/32] selinux: Use mem_to_flex_dup() with xfrm and sidtab Kees Cook
2022-05-04 22:57 ` Paul Moore
2022-05-04 23:43 ` Gustavo A. R. Silva
2022-05-05 3:14 ` Paul Moore
2022-05-05 18:39 ` Kees Cook
2022-05-05 23:16 ` Paul Moore
2022-05-06 1:08 ` Gustavo A. R. Silva
2022-05-04 1:44 ` [PATCH 29/32] xtensa: Use mem_to_flex_dup() with struct property Kees Cook
2022-05-04 18:09 ` Rob Herring
2022-05-04 1:44 ` [PATCH 30/32] usb: gadget: f_fs: Use mem_to_flex_dup() with struct ffs_buffer Kees Cook
2022-05-04 1:44 ` [PATCH 31/32] xenbus: Use mem_to_flex_dup() with struct read_buffer Kees Cook
2022-05-04 1:44 ` [PATCH 32/32] esas2r: Use __mem_to_flex() with struct atto_ioctl Kees Cook
2022-05-12 21:41 ` [PATCH 19/32] afs: Use mem_to_flex_dup() with struct afs_acl David Howells
2022-05-13 15:44 ` Kees Cook
2022-05-12 21:47 ` [PATCH 00/32] Introduce flexible array struct memcpy() helpers David Howells
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220504014440.3697851-2-keescook@chromium.org \
--to=keescook@chromium.org \
--cc=SHA-cyfmac-dev-list@infineon.com \
--cc=agross@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=alsa-devel@alsa-project.org \
--cc=andrew_gabbasov@mentor.com \
--cc=andy.lavr@gmail.com \
--cc=aspriel@gmail.com \
--cc=ast@kernel.org \
--cc=axboe@kernel.dk \
--cc=balbi@kernel.org \
--cc=baowen.zheng@corigine.com \
--cc=bjorn.andersson@linaro.org \
--cc=boris.ostrovsky@oracle.com \
--cc=brauner@kernel.org \
--cc=brcm80211-dev-list.pdl@broadcom.com \
--cc=broonie@kernel.org \
--cc=cgzones@googlemail.com \
--cc=chris@zankel.net \
--cc=chunkeey@googlemail.com \
--cc=cong.wang@bytedance.com \
--cc=dalias@aerifal.cx \
--cc=dan.j.williams@intel.com \
--cc=daniel.vetter@ffwll.ch \
--cc=davem@davemloft.net \
--cc=davidgow@google.com \
--cc=decui@microsoft.com \
--cc=dennis.dalessandro@cornelisnetworks.com \
--cc=devicetree@vger.kernel.org \
--cc=dhowells@redhat.com \
--cc=dja@axtens.net \
--cc=dmitry.kasatkin@gmail.com \
--cc=edumazet@google.com \
--cc=elic@nvidia.com \
--cc=eparis@parisplace.org \
--cc=erosca@de.adit-jv.com \
--cc=franky.lin@broadcom.com \
--cc=frowand.list@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=gregory.greenman@intel.com \
--cc=gustavoars@kernel.org \
--cc=haiyangz@microsoft.com \
--cc=hante.meuleman@broadcom.com \
--cc=herbert@gondor.apana.org.au \
--cc=hulkci@huawei.com \
--cc=jarkko@kernel.org \
--cc=jcmvbkbc@gmail.com \
--cc=jejb@linux.ibm.com \
--cc=jgg@ziepe.ca \
--cc=jgross@suse.com \
--cc=jmorris@namei.org \
--cc=johan.hedberg@gmail.com \
--cc=johannes.berg@intel.com \
--cc=johannes@sipsolutions.net \
--cc=john@metanate.com \
--cc=keithp@keithp.com \
--cc=keyrings@vger.kernel.org \
--cc=kuba@kernel.org \
--cc=kunit-dev@googlegroups.com \
--cc=kuniyu@amazon.co.jp \
--cc=kvalo@kernel.org \
--cc=kys@microsoft.com \
--cc=laniel_francis@privacyrequired.com \
--cc=lars@metafoo.de \
--cc=lee.jones@linaro.org \
--cc=leon@kernel.org \
--cc=lgirdwood@gmail.com \
--cc=linux-afs@lists.infradead.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-hyperv@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=linux-xtensa@linux-xtensa.org \
--cc=linux1394-devel@lists.sourceforge.net \
--cc=linux@armlinux.org.uk \
--cc=linux@rasmusvillemoes.dk \
--cc=linux@roeck-us.net \
--cc=linuxdrivers@attotech.com \
--cc=llvm@lists.linux.dev \
--cc=loic.poulain@linaro.org \
--cc=louis.peens@corigine.com \
--cc=luciano.coelho@intel.com \
--cc=luiz.dentz@gmail.com \
--cc=marc.dionne@auristor.com \
--cc=marcel@holtmann.org \
--cc=martin.petersen@oracle.com \
--cc=nathan@kernel.org \
--cc=ndesaulniers@google.com \
--cc=netdev@vger.kernel.org \
--cc=nuno.sa@analog.com \
--cc=pabeni@redhat.com \
--cc=paul@paul-moore.com \
--cc=perex@perex.cz \
--cc=quic_ugoswami@quicinc.com \
--cc=robh+dt@kernel.org \
--cc=selinux@vger.kernel.org \
--cc=serge@hallyn.com \
--cc=simon.horman@corigine.com \
--cc=songmuchun@bytedance.com \
--cc=sstabellini@kernel.org \
--cc=stefanr@s5r6.in-berlin.de \
--cc=steffen.klassert@secunet.com \
--cc=stephen.smalley.work@gmail.com \
--cc=sthemmin@microsoft.com \
--cc=tadeusz.struk@linaro.org \
--cc=tiwai@suse.com \
--cc=trix@redhat.com \
--cc=vincenzo.frascino@arm.com \
--cc=viro@zeniv.linux.org.uk \
--cc=wcn36xx@lists.infradead.org \
--cc=wei.liu@kernel.org \
--cc=xen-devel@lists.xenproject.org \
--cc=xiujianfeng@huawei.com \
--cc=yangyingliang@huawei.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).