linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>,
	Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>,
	"David S . Miller" <davem@davemloft.net>,
	Sasha Levin <sashal@kernel.org>,
	netdev@vger.kernel.org, llvm@lists.linux.dev
Subject: [PATCH AUTOSEL 5.14 23/32] flow: fix object-size-mismatch warning in flowi{4,6}_to_flowi_common()
Date: Sat, 11 Sep 2021 09:11:40 -0400	[thread overview]
Message-ID: <20210911131149.284397-23-sashal@kernel.org> (raw)
In-Reply-To: <20210911131149.284397-1-sashal@kernel.org>

From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>

[ Upstream commit b9edbfe1adecfc48fd11061dce68afb03d6adbdc ]

Commit 3df98d79215ace13 ("lsm,selinux: pass flowi_common instead of flowi
to the LSM hooks") introduced flowi{4,6}_to_flowi_common() functions which
cause UBSAN warning when building with LLVM 11.0.1 on Ubuntu 21.04.

 ================================================================================
 UBSAN: object-size-mismatch in ./include/net/flow.h:197:33
 member access within address ffffc9000109fbd8 with insufficient space
 for an object of type 'struct flowi'
 CPU: 2 PID: 7410 Comm: systemd-resolve Not tainted 5.14.0 #51
 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 02/27/2020
 Call Trace:
  dump_stack_lvl+0x103/0x171
  ubsan_type_mismatch_common+0x1de/0x390
  __ubsan_handle_type_mismatch_v1+0x41/0x50
  udp_sendmsg+0xda2/0x1300
  ? ip_skb_dst_mtu+0x1f0/0x1f0
  ? sock_rps_record_flow+0xe/0x200
  ? inet_send_prepare+0x2d/0x90
  sock_sendmsg+0x49/0x80
  ____sys_sendmsg+0x269/0x370
  __sys_sendmsg+0x15e/0x1d0
  ? syscall_enter_from_user_mode+0xf0/0x1b0
  do_syscall_64+0x3d/0xb0
  entry_SYSCALL_64_after_hwframe+0x44/0xae
 RIP: 0033:0x7f7081a50497
 Code: 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
 RSP: 002b:00007ffc153870f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
 RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007f7081a50497
 RDX: 0000000000000000 RSI: 00007ffc15387140 RDI: 000000000000000c
 RBP: 00007ffc15387140 R08: 0000563f29a5e4fc R09: 000000000000cd28
 R10: 0000563f29a68a30 R11: 0000000000000246 R12: 000000000000000c
 R13: 0000000000000001 R14: 0000563f29a68a30 R15: 0000563f29a5e50c
 ================================================================================

I don't think we need to call flowi{4,6}_to_flowi() from these functions
because the first member of "struct flowi4" and "struct flowi6" is

  struct flowi_common __fl_common;

while the first member of "struct flowi" is

  union {
    struct flowi_common __fl_common;
    struct flowi4       ip4;
    struct flowi6       ip6;
    struct flowidn      dn;
  } u;

which should point to the same address without access to "struct flowi".

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/flow.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/net/flow.h b/include/net/flow.h
index 6f5e70240071..58beb16a49b8 100644
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -194,7 +194,7 @@ static inline struct flowi *flowi4_to_flowi(struct flowi4 *fl4)
 
 static inline struct flowi_common *flowi4_to_flowi_common(struct flowi4 *fl4)
 {
-	return &(flowi4_to_flowi(fl4)->u.__fl_common);
+	return &(fl4->__fl_common);
 }
 
 static inline struct flowi *flowi6_to_flowi(struct flowi6 *fl6)
@@ -204,7 +204,7 @@ static inline struct flowi *flowi6_to_flowi(struct flowi6 *fl6)
 
 static inline struct flowi_common *flowi6_to_flowi_common(struct flowi6 *fl6)
 {
-	return &(flowi6_to_flowi(fl6)->u.__fl_common);
+	return &(fl6->__fl_common);
 }
 
 static inline struct flowi *flowidn_to_flowi(struct flowidn *fldn)
-- 
2.30.2


  parent reply	other threads:[~2021-09-11 13:13 UTC|newest]

Thread overview: 34+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-09-11 13:11 [PATCH AUTOSEL 5.14 01/32] dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 02/32] remoteproc: qcom: wcnss: Fix race with iris probe Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 03/32] mfd: db8500-prcmu: Adjust map to reality Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 04/32] PCI: Add ACS quirks for NXP LX2xx0 and LX2xx2 platforms Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 05/32] fuse: fix use after free in fuse_read_interrupt() Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 06/32] PCI: tegra194: Fix handling BME_CHGED event Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 07/32] PCI: tegra194: Fix MSI-X programming Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 08/32] PCI: tegra: Fix OF node reference leak Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 09/32] mfd: Don't use irq_create_mapping() to resolve a mapping Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 10/32] PCI: rcar: Fix runtime PM imbalance in rcar_pcie_ep_probe() Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 11/32] riscv: fix the global name pfn_base confliction error Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 12/32] PCI: rcar: Add L1 link state fix into data abort hook Sasha Levin
2021-09-11 16:05   ` Marek Vasut
2021-09-20 12:12     ` Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 13/32] KVM: arm64: Make hyp_panic() more robust when protected mode is enabled Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 14/32] tracing/probes: Reject events which have the same name of existing one Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 15/32] PCI: cadence: Use bitfield for *quirk_retrain_flag* instead of bool Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 16/32] PCI: cadence: Add quirk flag to set minimum delay in LTSSM Detect.Quiet state Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 17/32] PCI: j721e: Add PCIe support for J7200 Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 18/32] PCI: j721e: Add PCIe support for AM64 Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 19/32] PCI: Add ACS quirks for Cavium multi-function devices Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 20/32] watchdog: Start watchdog in watchdog_set_last_hw_keepalive only if appropriate Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 21/32] octeontx2-af: Add additional register check to rvu_poll_reg() Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 22/32] Set fc_nlinfo in nh_create_ipv4, nh_create_ipv6 Sasha Levin
2021-09-11 13:11 ` Sasha Levin [this message]
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 24/32] net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920 Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 25/32] block, bfq: honor already-setup queue merges Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 26/32] PCI: ibmphp: Fix double unmap of io_mem Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 27/32] loop: reduce the loop_ctl_mutex scope Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 28/32] ethtool: Fix an error code in cxgb2.c Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 29/32] NTB: Fix an error code in ntb_msit_probe() Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 30/32] NTB: perf: Fix an error code in perf_setup_inbuf() Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 31/32] stmmac: dwmac-loongson:Fix missing return value Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 32/32] net: phylink: add suspend/resume support Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210911131149.284397-23-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=davem@davemloft.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=llvm@lists.linux.dev \
    --cc=netdev@vger.kernel.org \
    --cc=penguin-kernel@i-love.sakura.ne.jp \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).