* [PATCH][next] wireless: wext-spy: Fix out-of-bounds warning
@ 2021-04-21 23:43 Gustavo A. R. Silva
2021-04-22 0:22 ` Kees Cook
2021-04-22 7:04 ` Johannes Berg
0 siblings, 2 replies; 4+ messages in thread
From: Gustavo A. R. Silva @ 2021-04-21 23:43 UTC (permalink / raw)
To: Johannes Berg, David S. Miller, Jakub Kicinski
Cc: linux-wireless, netdev, linux-kernel, Gustavo A. R. Silva,
linux-hardening, Kees Cook
Fix the following out-of-bounds warning:
net/wireless/wext-spy.c:178:2: warning: 'memcpy' offset [25, 28] from the object at 'threshold' is out of the bounds of referenced subobject 'low' with type 'struct iw_quality' at offset 20 [-Warray-bounds]
The problem is that the original code is trying to copy data into a
couple of struct members adjacent to each other in a single call to
memcpy(). This causes a legitimate compiler warning because memcpy()
overruns the length of &threshold.low and &spydata->spy_thr_low. As
these are just a couple of members, fix this by copying each one of
them in separate calls to memcpy().
Also, while there, use sizeof(threshold.qual) instead of
sizeof(struct iw_quality)) in another call to memcpy()
above.
This helps with the ongoing efforts to globally enable -Warray-bounds
and get us closer to being able to tighten the FORTIFY_SOURCE routines
on memcpy().
Link: https://github.com/KSPP/linux/issues/109
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
net/wireless/wext-spy.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/net/wireless/wext-spy.c b/net/wireless/wext-spy.c
index 33bef22e44e9..bb2de7c6bee4 100644
--- a/net/wireless/wext-spy.c
+++ b/net/wireless/wext-spy.c
@@ -120,8 +120,8 @@ int iw_handler_set_thrspy(struct net_device * dev,
return -EOPNOTSUPP;
/* Just do it */
- memcpy(&(spydata->spy_thr_low), &(threshold->low),
- 2 * sizeof(struct iw_quality));
+ memcpy(&spydata->spy_thr_low, &threshold->low, sizeof(threshold->low));
+ memcpy(&spydata->spy_thr_high, &threshold->high, sizeof(threshold->high));
/* Clear flag */
memset(spydata->spy_thr_under, '\0', sizeof(spydata->spy_thr_under));
@@ -173,10 +173,10 @@ static void iw_send_thrspy_event(struct net_device * dev,
memcpy(threshold.addr.sa_data, address, ETH_ALEN);
threshold.addr.sa_family = ARPHRD_ETHER;
/* Copy stats */
- memcpy(&(threshold.qual), wstats, sizeof(struct iw_quality));
+ memcpy(&threshold.qual, wstats, sizeof(threshold.qual));
/* Copy also thresholds */
- memcpy(&(threshold.low), &(spydata->spy_thr_low),
- 2 * sizeof(struct iw_quality));
+ memcpy(&threshold.low, &spydata->spy_thr_low, sizeof(threshold.low));
+ memcpy(&threshold.high, &spydata->spy_thr_high, sizeof(threshold.high));
/* Send event to user space */
wireless_send_event(dev, SIOCGIWTHRSPY, &wrqu, (char *) &threshold);
--
2.27.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH][next] wireless: wext-spy: Fix out-of-bounds warning
2021-04-21 23:43 [PATCH][next] wireless: wext-spy: Fix out-of-bounds warning Gustavo A. R. Silva
@ 2021-04-22 0:22 ` Kees Cook
2021-04-22 7:04 ` Johannes Berg
1 sibling, 0 replies; 4+ messages in thread
From: Kees Cook @ 2021-04-22 0:22 UTC (permalink / raw)
To: Gustavo A. R. Silva
Cc: Johannes Berg, David S. Miller, Jakub Kicinski, linux-wireless,
netdev, linux-kernel, linux-hardening
On Wed, Apr 21, 2021 at 06:43:37PM -0500, Gustavo A. R. Silva wrote:
> Fix the following out-of-bounds warning:
>
> net/wireless/wext-spy.c:178:2: warning: 'memcpy' offset [25, 28] from the object at 'threshold' is out of the bounds of referenced subobject 'low' with type 'struct iw_quality' at offset 20 [-Warray-bounds]
>
> The problem is that the original code is trying to copy data into a
> couple of struct members adjacent to each other in a single call to
> memcpy(). This causes a legitimate compiler warning because memcpy()
> overruns the length of &threshold.low and &spydata->spy_thr_low. As
> these are just a couple of members, fix this by copying each one of
> them in separate calls to memcpy().
>
> Also, while there, use sizeof(threshold.qual) instead of
> sizeof(struct iw_quality)) in another call to memcpy()
> above.
>
> This helps with the ongoing efforts to globally enable -Warray-bounds
> and get us closer to being able to tighten the FORTIFY_SOURCE routines
> on memcpy().
>
> Link: https://github.com/KSPP/linux/issues/109
> Reported-by: kernel test robot <lkp@intel.com>
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Thanks!
Reviewed-by: Kees Cook <keescook@chromium.org>
-Kees
> ---
> net/wireless/wext-spy.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/net/wireless/wext-spy.c b/net/wireless/wext-spy.c
> index 33bef22e44e9..bb2de7c6bee4 100644
> --- a/net/wireless/wext-spy.c
> +++ b/net/wireless/wext-spy.c
> @@ -120,8 +120,8 @@ int iw_handler_set_thrspy(struct net_device * dev,
> return -EOPNOTSUPP;
>
> /* Just do it */
> - memcpy(&(spydata->spy_thr_low), &(threshold->low),
> - 2 * sizeof(struct iw_quality));
> + memcpy(&spydata->spy_thr_low, &threshold->low, sizeof(threshold->low));
> + memcpy(&spydata->spy_thr_high, &threshold->high, sizeof(threshold->high));
>
> /* Clear flag */
> memset(spydata->spy_thr_under, '\0', sizeof(spydata->spy_thr_under));
> @@ -173,10 +173,10 @@ static void iw_send_thrspy_event(struct net_device * dev,
> memcpy(threshold.addr.sa_data, address, ETH_ALEN);
> threshold.addr.sa_family = ARPHRD_ETHER;
> /* Copy stats */
> - memcpy(&(threshold.qual), wstats, sizeof(struct iw_quality));
> + memcpy(&threshold.qual, wstats, sizeof(threshold.qual));
> /* Copy also thresholds */
> - memcpy(&(threshold.low), &(spydata->spy_thr_low),
> - 2 * sizeof(struct iw_quality));
> + memcpy(&threshold.low, &spydata->spy_thr_low, sizeof(threshold.low));
> + memcpy(&threshold.high, &spydata->spy_thr_high, sizeof(threshold.high));
>
> /* Send event to user space */
> wireless_send_event(dev, SIOCGIWTHRSPY, &wrqu, (char *) &threshold);
> --
> 2.27.0
>
--
Kees Cook
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH][next] wireless: wext-spy: Fix out-of-bounds warning
2021-04-21 23:43 [PATCH][next] wireless: wext-spy: Fix out-of-bounds warning Gustavo A. R. Silva
2021-04-22 0:22 ` Kees Cook
@ 2021-04-22 7:04 ` Johannes Berg
2021-04-22 20:03 ` Gustavo A. R. Silva
1 sibling, 1 reply; 4+ messages in thread
From: Johannes Berg @ 2021-04-22 7:04 UTC (permalink / raw)
To: Gustavo A. R. Silva, David S. Miller, Jakub Kicinski
Cc: linux-wireless, netdev, linux-kernel, linux-hardening, Kees Cook
On Wed, 2021-04-21 at 18:43 -0500, Gustavo A. R. Silva wrote:
>
> /* Just do it */
> - memcpy(&(spydata->spy_thr_low), &(threshold->low),
> - 2 * sizeof(struct iw_quality));
> + memcpy(&spydata->spy_thr_low, &threshold->low, sizeof(threshold->low));
> + memcpy(&spydata->spy_thr_high, &threshold->high, sizeof(threshold->high));
>
It would've been really simple to stick to 80 columns here (and
everywhere in the patch), please do that.
Also, why not just use struct assigments?
spydata->spy_thr_low = threshold->low;
etc.
Seems far simpler (and shorter lines).
johannes
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH][next] wireless: wext-spy: Fix out-of-bounds warning
2021-04-22 7:04 ` Johannes Berg
@ 2021-04-22 20:03 ` Gustavo A. R. Silva
0 siblings, 0 replies; 4+ messages in thread
From: Gustavo A. R. Silva @ 2021-04-22 20:03 UTC (permalink / raw)
To: Johannes Berg, Gustavo A. R. Silva, David S. Miller, Jakub Kicinski
Cc: linux-wireless, netdev, linux-kernel, linux-hardening, Kees Cook
On 4/22/21 02:04, Johannes Berg wrote:
> On Wed, 2021-04-21 at 18:43 -0500, Gustavo A. R. Silva wrote:
>>
>> /* Just do it */
>> - memcpy(&(spydata->spy_thr_low), &(threshold->low),
>> - 2 * sizeof(struct iw_quality));
>> + memcpy(&spydata->spy_thr_low, &threshold->low, sizeof(threshold->low));
>> + memcpy(&spydata->spy_thr_high, &threshold->high, sizeof(threshold->high));
>>
>
> It would've been really simple to stick to 80 columns here (and
> everywhere in the patch), please do that.
>
> Also, why not just use struct assigments?
>
> spydata->spy_thr_low = threshold->low;
>
> etc.
> Done: https://lore.kernel.org/lkml/20210422200032.GA168995@embeddedor/
> Seems far simpler (and shorter lines).
Done:
https://lore.kernel.org/lkml/20210422200032.GA168995@embeddedor/
Thanks for the feedback.
--
Gustavo
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-04-22 20:27 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-21 23:43 [PATCH][next] wireless: wext-spy: Fix out-of-bounds warning Gustavo A. R. Silva
2021-04-22 0:22 ` Kees Cook
2021-04-22 7:04 ` Johannes Berg
2021-04-22 20:03 ` Gustavo A. R. Silva
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.