* [PATCH] scsi: scsi_transport_fc: Adjust struct fc_nl_event flex array usage
@ 2022-09-21 20:51 Kees Cook
2022-09-22 5:31 ` Sachin Sant
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Kees Cook @ 2022-09-21 20:51 UTC (permalink / raw)
To: James E.J. Bottomley
Cc: Kees Cook, Sachin Sant, Martin K. Petersen, linux-scsi,
linux-kernel, linux-hardening
In order to help the compiler reason about the destination buffer in
struct fc_nl_event, add a flexible array member for this purpose.
However, since the header is UAPI, it must not change size or layout, so
a union is used.
The allocation size calculations are also corrected (it was potentially
allocating an extra 8 bytes), and the padding is zeroed to avoid leaking
kernel heap memory contents.
Detected at run-time by the recently added memcpy() bounds checking:
memcpy: detected field-spanning write (size 8) of single field "&event->event_data" at drivers/scsi/scsi_transport_fc.c:581 (size 4)
Reported-by: Sachin Sant <sachinp@linux.ibm.com>
Link: https://lore.kernel.org/linux-next/42404B5E-198B-4FD3-94D6-5E16CF579EF3@linux.ibm.com/
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: linux-scsi@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
---
drivers/scsi/scsi_transport_fc.c | 8 +++++---
include/uapi/scsi/scsi_netlink_fc.h | 7 +++++--
2 files changed, 10 insertions(+), 5 deletions(-)
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index a2524106206d..0d798f11dc34 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -543,7 +543,7 @@ fc_host_post_fc_event(struct Scsi_Host *shost, u32 event_number,
struct nlmsghdr *nlh;
struct fc_nl_event *event;
const char *name;
- u32 len;
+ size_t len, padding;
int err;
if (!data_buf || data_len < 4)
@@ -554,7 +554,7 @@ fc_host_post_fc_event(struct Scsi_Host *shost, u32 event_number,
goto send_fail;
}
- len = FC_NL_MSGALIGN(sizeof(*event) + data_len);
+ len = FC_NL_MSGALIGN(sizeof(*event) - sizeof(event->event_data) + data_len);
skb = nlmsg_new(len, GFP_KERNEL);
if (!skb) {
@@ -578,7 +578,9 @@ fc_host_post_fc_event(struct Scsi_Host *shost, u32 event_number,
event->event_num = event_number;
event->event_code = event_code;
if (data_len)
- memcpy(&event->event_data, data_buf, data_len);
+ memcpy(event->event_data_flex, data_buf, data_len);
+ padding = len - offsetof(typeof(*event), event_data_flex) - data_len;
+ memset(event->event_data_flex + data_len, 0, padding);
nlmsg_multicast(scsi_nl_sock, skb, 0, SCSI_NL_GRP_FC_EVENTS,
GFP_KERNEL);
diff --git a/include/uapi/scsi/scsi_netlink_fc.h b/include/uapi/scsi/scsi_netlink_fc.h
index 7535253f1a96..b46e9cbeb001 100644
--- a/include/uapi/scsi/scsi_netlink_fc.h
+++ b/include/uapi/scsi/scsi_netlink_fc.h
@@ -35,7 +35,7 @@
* FC Transport Broadcast Event Message :
* FC_NL_ASYNC_EVENT
*
- * Note: if Vendor Unique message, &event_data will be start of
+ * Note: if Vendor Unique message, event_data_flex will be start of
* vendor unique payload, and the length of the payload is
* per event_datalen
*
@@ -50,7 +50,10 @@ struct fc_nl_event {
__u16 event_datalen;
__u32 event_num;
__u32 event_code;
- __u32 event_data;
+ union {
+ __u32 event_data;
+ __DECLARE_FLEX_ARRAY(__u8, event_data_flex);
+ };
} __attribute__((aligned(sizeof(__u64))));
--
2.34.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] scsi: scsi_transport_fc: Adjust struct fc_nl_event flex array usage
2022-09-21 20:51 [PATCH] scsi: scsi_transport_fc: Adjust struct fc_nl_event flex array usage Kees Cook
@ 2022-09-22 5:31 ` Sachin Sant
2022-09-22 22:22 ` James Smart
2022-09-25 16:53 ` Martin K. Petersen
2 siblings, 0 replies; 4+ messages in thread
From: Sachin Sant @ 2022-09-22 5:31 UTC (permalink / raw)
To: Kees Cook
Cc: James E.J. Bottomley, Martin K. Petersen, linux-scsi,
linux-kernel, linux-hardening
> On 22-Sep-2022, at 2:21 AM, Kees Cook <keescook@chromium.org> wrote:
>
> In order to help the compiler reason about the destination buffer in
> struct fc_nl_event, add a flexible array member for this purpose.
> However, since the header is UAPI, it must not change size or layout, so
> a union is used.
>
> The allocation size calculations are also corrected (it was potentially
> allocating an extra 8 bytes), and the padding is zeroed to avoid leaking
> kernel heap memory contents.
>
> Detected at run-time by the recently added memcpy() bounds checking:
>
> memcpy: detected field-spanning write (size 8) of single field "&event->event_data" at drivers/scsi/scsi_transport_fc.c:581 (size 4)
>
> Reported-by: Sachin Sant <sachinp@linux.ibm.com>
> Link: https://lore.kernel.org/linux-next/42404B5E-198B-4FD3-94D6-5E16CF579EF3@linux.ibm.com/
> Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
> Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
> Cc: linux-scsi@vger.kernel.org
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
Thanks for the fix. With this patch applied the warning is no longer seen.
Tested-by: Sachin Sant <sachinp@linux.ibm.com>
> drivers/scsi/scsi_transport_fc.c | 8 +++++---
> include/uapi/scsi/scsi_netlink_fc.h | 7 +++++--
> 2 files changed, 10 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
> index a2524106206d..0d798f11dc34 100644
> --- a/drivers/scsi/scsi_transport_fc.c
> +++ b/drivers/scsi/scsi_transport_fc.c
> @@ -543,7 +543,7 @@ fc_host_post_fc_event(struct Scsi_Host *shost, u32 event_number,
> struct nlmsghdr *nlh;
> struct fc_nl_event *event;
> const char *name;
> - u32 len;
> + size_t len, padding;
> int err;
>
> if (!data_buf || data_len < 4)
> @@ -554,7 +554,7 @@ fc_host_post_fc_event(struct Scsi_Host *shost, u32 event_number,
> goto send_fail;
> }
>
> - len = FC_NL_MSGALIGN(sizeof(*event) + data_len);
> + len = FC_NL_MSGALIGN(sizeof(*event) - sizeof(event->event_data) + data_len);
>
> skb = nlmsg_new(len, GFP_KERNEL);
> if (!skb) {
> @@ -578,7 +578,9 @@ fc_host_post_fc_event(struct Scsi_Host *shost, u32 event_number,
> event->event_num = event_number;
> event->event_code = event_code;
> if (data_len)
> - memcpy(&event->event_data, data_buf, data_len);
> + memcpy(event->event_data_flex, data_buf, data_len);
> + padding = len - offsetof(typeof(*event), event_data_flex) - data_len;
> + memset(event->event_data_flex + data_len, 0, padding);
>
> nlmsg_multicast(scsi_nl_sock, skb, 0, SCSI_NL_GRP_FC_EVENTS,
> GFP_KERNEL);
> diff --git a/include/uapi/scsi/scsi_netlink_fc.h b/include/uapi/scsi/scsi_netlink_fc.h
> index 7535253f1a96..b46e9cbeb001 100644
> --- a/include/uapi/scsi/scsi_netlink_fc.h
> +++ b/include/uapi/scsi/scsi_netlink_fc.h
> @@ -35,7 +35,7 @@
> * FC Transport Broadcast Event Message :
> * FC_NL_ASYNC_EVENT
> *
> - * Note: if Vendor Unique message, &event_data will be start of
> + * Note: if Vendor Unique message, event_data_flex will be start of
> * vendor unique payload, and the length of the payload is
> * per event_datalen
> *
> @@ -50,7 +50,10 @@ struct fc_nl_event {
> __u16 event_datalen;
> __u32 event_num;
> __u32 event_code;
> - __u32 event_data;
> + union {
> + __u32 event_data;
> + __DECLARE_FLEX_ARRAY(__u8, event_data_flex);
> + };
> } __attribute__((aligned(sizeof(__u64))));
>
>
> --
> 2.34.1
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] scsi: scsi_transport_fc: Adjust struct fc_nl_event flex array usage
2022-09-21 20:51 [PATCH] scsi: scsi_transport_fc: Adjust struct fc_nl_event flex array usage Kees Cook
2022-09-22 5:31 ` Sachin Sant
@ 2022-09-22 22:22 ` James Smart
2022-09-25 16:53 ` Martin K. Petersen
2 siblings, 0 replies; 4+ messages in thread
From: James Smart @ 2022-09-22 22:22 UTC (permalink / raw)
To: Kees Cook, James E.J. Bottomley
Cc: Sachin Sant, Martin K. Petersen, linux-scsi, linux-kernel,
linux-hardening
On 9/21/2022 1:51 PM, Kees Cook wrote:
> In order to help the compiler reason about the destination buffer in
> struct fc_nl_event, add a flexible array member for this purpose.
> However, since the header is UAPI, it must not change size or layout, so
> a union is used.
>
> The allocation size calculations are also corrected (it was potentially
> allocating an extra 8 bytes), and the padding is zeroed to avoid leaking
> kernel heap memory contents.
>
> Detected at run-time by the recently added memcpy() bounds checking:
>
> memcpy: detected field-spanning write (size 8) of single field "&event->event_data" at drivers/scsi/scsi_transport_fc.c:581 (size 4)
>
> Reported-by: Sachin Sant <sachinp@linux.ibm.com>
> Link: https://lore.kernel.org/linux-next/42404B5E-198B-4FD3-94D6-5E16CF579EF3@linux.ibm.com/
> Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
> Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
> Cc: linux-scsi@vger.kernel.org
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
Kinda crazy way to resolve it, but looks fine.
Reviewed-by: James Smart <jsmart2021@gmail.com>
-- james
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] scsi: scsi_transport_fc: Adjust struct fc_nl_event flex array usage
2022-09-21 20:51 [PATCH] scsi: scsi_transport_fc: Adjust struct fc_nl_event flex array usage Kees Cook
2022-09-22 5:31 ` Sachin Sant
2022-09-22 22:22 ` James Smart
@ 2022-09-25 16:53 ` Martin K. Petersen
2 siblings, 0 replies; 4+ messages in thread
From: Martin K. Petersen @ 2022-09-25 16:53 UTC (permalink / raw)
To: Kees Cook
Cc: James E.J. Bottomley, Sachin Sant, Martin K. Petersen,
linux-scsi, linux-kernel, linux-hardening
Kees,
> In order to help the compiler reason about the destination buffer in
> struct fc_nl_event, add a flexible array member for this purpose.
> However, since the header is UAPI, it must not change size or layout,
> so a union is used.
Applied to 6.1/scsi-staging, thanks!
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-09-25 16:53 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-09-21 20:51 [PATCH] scsi: scsi_transport_fc: Adjust struct fc_nl_event flex array usage Kees Cook
2022-09-22 5:31 ` Sachin Sant
2022-09-22 22:22 ` James Smart
2022-09-25 16:53 ` Martin K. Petersen
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.