From: Kees Cook <keescook@chromium.org>
To: "Gustavo A . R . Silva" <gustavoars@kernel.org>
Cc: "Kees Cook" <keescook@chromium.org>,
"David S. Miller" <davem@davemloft.net>,
"Eric Dumazet" <edumazet@google.com>,
"Jakub Kicinski" <kuba@kernel.org>,
"Paolo Abeni" <pabeni@redhat.com>,
"Yang Yingliang" <yangyingliang@huawei.com>,
netdev@vger.kernel.org, "Alexei Starovoitov" <ast@kernel.org>,
alsa-devel@alsa-project.org, "Al Viro" <viro@zeniv.linux.org.uk>,
"Andrew Gabbasov" <andrew_gabbasov@mentor.com>,
"Andrew Morton" <akpm@linux-foundation.org>,
"Andy Gross" <agross@kernel.org>,
"Andy Lavr" <andy.lavr@gmail.com>,
"Arend van Spriel" <aspriel@gmail.com>,
"Baowen Zheng" <baowen.zheng@corigine.com>,
"Bjorn Andersson" <bjorn.andersson@linaro.org>,
"Boris Ostrovsky" <boris.ostrovsky@oracle.com>,
"Bradley Grove" <linuxdrivers@attotech.com>,
brcm80211-dev-list.pdl@broadcom.com,
"Christian Brauner" <brauner@kernel.org>,
"Christian Göttsche" <cgzones@googlemail.com>,
"Christian Lamparter" <chunkeey@googlemail.com>,
"Chris Zankel" <chris@zankel.net>,
"Cong Wang" <cong.wang@bytedance.com>,
"Daniel Axtens" <dja@axtens.net>,
"Daniel Vetter" <daniel.vetter@ffwll.ch>,
"Dan Williams" <dan.j.williams@intel.com>,
"David Gow" <davidgow@google.com>,
"David Howells" <dhowells@redhat.com>,
"Dennis Dalessandro" <dennis.dalessandro@cornelisnetworks.com>,
devicetree@vger.kernel.org, "Dexuan Cui" <decui@microsoft.com>,
"Dmitry Kasatkin" <dmitry.kasatkin@gmail.com>,
"Eli Cohen" <elic@nvidia.com>,
"Eric Paris" <eparis@parisplace.org>,
"Eugeniu Rosca" <erosca@de.adit-jv.com>,
"Felipe Balbi" <balbi@kernel.org>,
"Francis Laniel" <laniel_francis@privacyrequired.com>,
"Frank Rowand" <frowand.list@gmail.com>,
"Franky Lin" <franky.lin@broadcom.com>,
"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
"Gregory Greenman" <gregory.greenman@intel.com>,
"Guenter Roeck" <linux@roeck-us.net>,
"Haiyang Zhang" <haiyangz@microsoft.com>,
"Hante Meuleman" <hante.meuleman@broadcom.com>,
"Herbert Xu" <herbert@gondor.apana.org.au>,
"Hulk Robot" <hulkci@huawei.com>,
"James E.J. Bottomley" <jejb@linux.ibm.com>,
"James Morris" <jmorris@namei.org>,
"Jarkko Sakkinen" <jarkko@kernel.org>,
"Jaroslav Kysela" <perex@perex.cz>,
"Jason Gunthorpe" <jgg@ziepe.ca>, "Jens Axboe" <axboe@kernel.dk>,
"Johan Hedberg" <johan.hedberg@gmail.com>,
"Johannes Berg" <johannes.berg@intel.com>,
"Johannes Berg" <johannes@sipsolutions.net>,
"John Keeping" <john@metanate.com>,
"Juergen Gross" <jgross@suse.com>,
"Kalle Valo" <kvalo@kernel.org>,
"Keith Packard" <keithp@keithp.com>,
keyrings@vger.kernel.org, kunit-dev@googlegroups.com,
"Kuniyuki Iwashima" <kuniyu@amazon.co.jp>,
"K. Y. Srinivasan" <kys@microsoft.com>,
"Lars-Peter Clausen" <lars@metafoo.de>,
"Lee Jones" <lee.jones@linaro.org>,
"Leon Romanovsky" <leon@kernel.org>,
"Liam Girdwood" <lgirdwood@gmail.com>,
linux1394-devel@lists.sourceforge.net,
linux-afs@lists.infradead.org,
linux-arm-kernel@lists.infradead.org,
linux-arm-msm@vger.kernel.org, linux-bluetooth@vger.kernel.org,
linux-hardening@vger.kernel.org, linux-hyperv@vger.kernel.org,
linux-integrity@vger.kernel.org, linux-rdma@vger.kernel.org,
linux-scsi@vger.kernel.org,
linux-security-module@vger.kernel.org, linux-usb@vger.kernel.org,
linux-wireless@vger.kernel.org, linux-xtensa@linux-xtensa.org,
llvm@lists.linux.dev, "Loic Poulain" <loic.poulain@linaro.org>,
"Louis Peens" <louis.peens@corigine.com>,
"Luca Coelho" <luciano.coelho@intel.com>,
"Luiz Augusto von Dentz" <luiz.dentz@gmail.com>,
"Marc Dionne" <marc.dionne@auristor.com>,
"Marcel Holtmann" <marcel@holtmann.org>,
"Mark Brown" <broonie@kernel.org>,
"Martin K. Petersen" <martin.petersen@oracle.com>,
"Max Filippov" <jcmvbkbc@gmail.com>,
"Mimi Zohar" <zohar@linux.ibm.com>,
"Muchun Song" <songmuchun@bytedance.com>,
"Nathan Chancellor" <nathan@kernel.org>,
"Nick Desaulniers" <ndesaulniers@google.com>,
"Nuno Sá" <nuno.sa@analog.com>,
"Paul Moore" <paul@paul-moore.com>,
"Rich Felker" <dalias@aerifal.cx>,
"Rob Herring" <robh+dt@kernel.org>,
"Russell King" <linux@armlinux.org.uk>,
selinux@vger.kernel.org, "Serge E. Hallyn" <serge@hallyn.com>,
SHA-cyfmac-dev-list@infineon.com,
"Simon Horman" <simon.horman@corigine.com>,
"Stefano Stabellini" <sstabellini@kernel.org>,
"Stefan Richter" <stefanr@s5r6.in-berlin.de>,
"Steffen Klassert" <steffen.klassert@secunet.com>,
"Stephen Hemminger" <sthemmin@microsoft.com>,
"Stephen Smalley" <stephen.smalley.work@gmail.com>,
"Tadeusz Struk" <tadeusz.struk@linaro.org>,
"Takashi Iwai" <tiwai@suse.com>, "Tom Rix" <trix@redhat.com>,
"Udipto Goswami" <quic_ugoswami@quicinc.com>,
"Vincenzo Frascino" <vincenzo.frascino@arm.com>,
wcn36xx@lists.infradead.org, "Wei Liu" <wei.liu@kernel.org>,
xen-devel@lists.xenproject.org,
"Xiu Jianfeng" <xiujianfeng@huawei.com>
Subject: [PATCH 16/32] 802/mrp: Use mem_to_flex_dup() with struct mrp_attr
Date: Tue, 3 May 2022 18:44:25 -0700 [thread overview]
Message-ID: <20220504014440.3697851-17-keescook@chromium.org> (raw)
In-Reply-To: <20220504014440.3697851-1-keescook@chromium.org>
As part of the work to perform bounds checking on all memcpy() uses,
replace the open-coded a deserialization of bytes out of memory into a
trailing flexible array by using a flex_array.h helper to perform the
allocation, bounds checking, and copying.
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Yang Yingliang <yangyingliang@huawei.com>
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
---
include/net/mrp.h | 4 ++--
net/802/mrp.c | 9 +++------
2 files changed, 5 insertions(+), 8 deletions(-)
diff --git a/include/net/mrp.h b/include/net/mrp.h
index 1c308c034e1a..211670bb46f2 100644
--- a/include/net/mrp.h
+++ b/include/net/mrp.h
@@ -91,8 +91,8 @@ struct mrp_attr {
struct rb_node node;
enum mrp_applicant_state state;
u8 type;
- u8 len;
- unsigned char value[];
+ DECLARE_FLEX_ARRAY_ELEMENTS_COUNT(u8, len);
+ DECLARE_FLEX_ARRAY_ELEMENTS(unsigned char, value);
};
enum mrp_applications {
diff --git a/net/802/mrp.c b/net/802/mrp.c
index 35e04cc5390c..8b9b2e685a42 100644
--- a/net/802/mrp.c
+++ b/net/802/mrp.c
@@ -257,7 +257,7 @@ static struct mrp_attr *mrp_attr_create(struct mrp_applicant *app,
const void *value, u8 len, u8 type)
{
struct rb_node *parent = NULL, **p = &app->mad.rb_node;
- struct mrp_attr *attr;
+ struct mrp_attr *attr = NULL;
int d;
while (*p) {
@@ -273,13 +273,10 @@ static struct mrp_attr *mrp_attr_create(struct mrp_applicant *app,
return attr;
}
}
- attr = kmalloc(sizeof(*attr) + len, GFP_ATOMIC);
- if (!attr)
- return attr;
+ if (mem_to_flex_dup(&attr, value, len, GFP_ATOMIC))
+ return NULL;
attr->state = MRP_APPLICANT_VO;
attr->type = type;
- attr->len = len;
- memcpy(attr->value, value, len);
rb_link_node(&attr->node, parent, p);
rb_insert_color(&attr->node, &app->mad);
--
2.32.0
next prev parent reply other threads:[~2022-05-04 1:51 UTC|newest]
Thread overview: 63+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-05-04 1:44 [PATCH 00/32] Introduce flexible array struct memcpy() helpers Kees Cook
2022-05-04 1:44 ` [PATCH 01/32] netlink: Avoid memcpy() across flexible array boundary Kees Cook
2022-05-04 3:31 ` Gustavo A. R. Silva
2022-05-04 3:37 ` Kees Cook
2022-05-04 1:44 ` [PATCH 02/32] Introduce flexible array struct memcpy() helpers Kees Cook
2022-05-04 7:25 ` Johannes Berg
2022-05-04 15:38 ` Kees Cook
2022-05-04 16:08 ` David Laight
2022-05-05 13:16 ` Johannes Berg
2022-05-05 15:16 ` Keith Packard
2022-05-05 19:32 ` Kees Cook
2022-05-05 20:08 ` Keith Packard
2022-05-05 20:12 ` Johannes Berg
2022-05-06 11:15 ` David Laight
2022-05-05 19:27 ` Kees Cook
2022-05-04 1:44 ` [PATCH 03/32] flex_array: Add Kunit tests Kees Cook
2022-05-04 3:00 ` David Gow
2022-05-04 19:43 ` Kees Cook
2022-05-04 19:58 ` Daniel Latypov
2022-05-04 1:44 ` [PATCH 04/32] fortify: Add run-time WARN for cross-field memcpy() Kees Cook
2022-05-04 1:44 ` [PATCH 05/32] brcmfmac: Use mem_to_flex_dup() with struct brcmf_fweh_queue_item Kees Cook
2022-05-04 1:44 ` [PATCH 06/32] iwlwifi: calib: Prepare to use mem_to_flex_dup() Kees Cook
2022-05-04 1:44 ` [PATCH 07/32] iwlwifi: calib: Use mem_to_flex_dup() with struct iwl_calib_result Kees Cook
2022-05-04 1:44 ` [PATCH 08/32] iwlwifi: mvm: Use mem_to_flex_dup() with struct ieee80211_key_conf Kees Cook
2022-05-04 1:44 ` [PATCH 09/32] p54: Use mem_to_flex_dup() with struct p54_cal_database Kees Cook
2022-05-04 1:44 ` [PATCH 10/32] wcn36xx: Use mem_to_flex_dup() with struct wcn36xx_hal_ind_msg Kees Cook
2022-05-04 5:42 ` Kalle Valo
2022-05-04 15:08 ` Kees Cook
2022-05-04 1:44 ` [PATCH 11/32] nl80211: Use mem_to_flex_dup() with struct cfg80211_cqm_config Kees Cook
2022-05-04 1:44 ` [PATCH 12/32] cfg80211: Use mem_to_flex_dup() with struct cfg80211_bss_ies Kees Cook
2022-05-04 7:28 ` Johannes Berg
2022-05-04 15:13 ` Kees Cook
2022-05-04 1:44 ` [PATCH 13/32] mac80211: Use mem_to_flex_dup() with several structs Kees Cook
2022-05-04 1:44 ` [PATCH 14/32] af_unix: Use mem_to_flex_dup() with struct unix_address Kees Cook
2022-05-04 1:44 ` [PATCH 15/32] 802/garp: Use mem_to_flex_dup() with struct garp_attr Kees Cook
2022-05-04 1:44 ` Kees Cook [this message]
2022-05-04 1:44 ` [PATCH 17/32] net/flow_offload: Use mem_to_flex_dup() with struct flow_action_cookie Kees Cook
2022-05-04 1:44 ` [PATCH 18/32] firewire: Use __mem_to_flex_dup() with struct iso_interrupt_event Kees Cook
2022-05-04 1:44 ` [PATCH 19/32] afs: Use mem_to_flex_dup() with struct afs_acl Kees Cook
2022-05-04 1:44 ` [PATCH 20/32] ASoC: sigmadsp: Use mem_to_flex_dup() with struct sigmadsp_data Kees Cook
2022-05-04 15:17 ` Mark Brown
2022-05-04 1:44 ` [PATCH 21/32] soc: qcom: apr: Use mem_to_flex_dup() with struct apr_rx_buf Kees Cook
2022-05-04 1:44 ` [PATCH 22/32] atags_proc: Use mem_to_flex_dup() with struct buffer Kees Cook
2022-05-04 1:44 ` [PATCH 23/32] Bluetooth: Use mem_to_flex_dup() with struct hci_op_configure_data_path Kees Cook
2022-05-04 1:44 ` [PATCH 24/32] IB/hfi1: Use mem_to_flex_dup() for struct tid_rb_node Kees Cook
2022-05-04 1:44 ` [PATCH 25/32] Drivers: hv: utils: Use mem_to_flex_dup() with struct cn_msg Kees Cook
2022-05-04 1:44 ` [PATCH 26/32] ima: Use mem_to_flex_dup() with struct modsig Kees Cook
2022-05-04 1:44 ` [PATCH 27/32] KEYS: Use mem_to_flex_dup() with struct user_key_payload Kees Cook
2022-05-04 1:44 ` [PATCH 28/32] selinux: Use mem_to_flex_dup() with xfrm and sidtab Kees Cook
2022-05-04 22:57 ` Paul Moore
2022-05-04 23:43 ` Gustavo A. R. Silva
2022-05-05 3:14 ` Paul Moore
2022-05-05 18:39 ` Kees Cook
2022-05-05 23:16 ` Paul Moore
2022-05-06 1:08 ` Gustavo A. R. Silva
2022-05-04 1:44 ` [PATCH 29/32] xtensa: Use mem_to_flex_dup() with struct property Kees Cook
2022-05-04 18:09 ` Rob Herring
2022-05-04 1:44 ` [PATCH 30/32] usb: gadget: f_fs: Use mem_to_flex_dup() with struct ffs_buffer Kees Cook
2022-05-04 1:44 ` [PATCH 31/32] xenbus: Use mem_to_flex_dup() with struct read_buffer Kees Cook
2022-05-04 1:44 ` [PATCH 32/32] esas2r: Use __mem_to_flex() with struct atto_ioctl Kees Cook
2022-05-12 21:41 ` [PATCH 19/32] afs: Use mem_to_flex_dup() with struct afs_acl David Howells
2022-05-13 15:44 ` Kees Cook
2022-05-12 21:47 ` [PATCH 00/32] Introduce flexible array struct memcpy() helpers David Howells
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220504014440.3697851-17-keescook@chromium.org \
--to=keescook@chromium.org \
--cc=SHA-cyfmac-dev-list@infineon.com \
--cc=agross@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=alsa-devel@alsa-project.org \
--cc=andrew_gabbasov@mentor.com \
--cc=andy.lavr@gmail.com \
--cc=aspriel@gmail.com \
--cc=ast@kernel.org \
--cc=axboe@kernel.dk \
--cc=balbi@kernel.org \
--cc=baowen.zheng@corigine.com \
--cc=bjorn.andersson@linaro.org \
--cc=boris.ostrovsky@oracle.com \
--cc=brauner@kernel.org \
--cc=brcm80211-dev-list.pdl@broadcom.com \
--cc=broonie@kernel.org \
--cc=cgzones@googlemail.com \
--cc=chris@zankel.net \
--cc=chunkeey@googlemail.com \
--cc=cong.wang@bytedance.com \
--cc=dalias@aerifal.cx \
--cc=dan.j.williams@intel.com \
--cc=daniel.vetter@ffwll.ch \
--cc=davem@davemloft.net \
--cc=davidgow@google.com \
--cc=decui@microsoft.com \
--cc=dennis.dalessandro@cornelisnetworks.com \
--cc=devicetree@vger.kernel.org \
--cc=dhowells@redhat.com \
--cc=dja@axtens.net \
--cc=dmitry.kasatkin@gmail.com \
--cc=edumazet@google.com \
--cc=elic@nvidia.com \
--cc=eparis@parisplace.org \
--cc=erosca@de.adit-jv.com \
--cc=franky.lin@broadcom.com \
--cc=frowand.list@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=gregory.greenman@intel.com \
--cc=gustavoars@kernel.org \
--cc=haiyangz@microsoft.com \
--cc=hante.meuleman@broadcom.com \
--cc=herbert@gondor.apana.org.au \
--cc=hulkci@huawei.com \
--cc=jarkko@kernel.org \
--cc=jcmvbkbc@gmail.com \
--cc=jejb@linux.ibm.com \
--cc=jgg@ziepe.ca \
--cc=jgross@suse.com \
--cc=jmorris@namei.org \
--cc=johan.hedberg@gmail.com \
--cc=johannes.berg@intel.com \
--cc=johannes@sipsolutions.net \
--cc=john@metanate.com \
--cc=keithp@keithp.com \
--cc=keyrings@vger.kernel.org \
--cc=kuba@kernel.org \
--cc=kunit-dev@googlegroups.com \
--cc=kuniyu@amazon.co.jp \
--cc=kvalo@kernel.org \
--cc=kys@microsoft.com \
--cc=laniel_francis@privacyrequired.com \
--cc=lars@metafoo.de \
--cc=lee.jones@linaro.org \
--cc=leon@kernel.org \
--cc=lgirdwood@gmail.com \
--cc=linux-afs@lists.infradead.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-hyperv@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=linux-xtensa@linux-xtensa.org \
--cc=linux1394-devel@lists.sourceforge.net \
--cc=linux@armlinux.org.uk \
--cc=linux@roeck-us.net \
--cc=linuxdrivers@attotech.com \
--cc=llvm@lists.linux.dev \
--cc=loic.poulain@linaro.org \
--cc=louis.peens@corigine.com \
--cc=luciano.coelho@intel.com \
--cc=luiz.dentz@gmail.com \
--cc=marc.dionne@auristor.com \
--cc=marcel@holtmann.org \
--cc=martin.petersen@oracle.com \
--cc=nathan@kernel.org \
--cc=ndesaulniers@google.com \
--cc=netdev@vger.kernel.org \
--cc=nuno.sa@analog.com \
--cc=pabeni@redhat.com \
--cc=paul@paul-moore.com \
--cc=perex@perex.cz \
--cc=quic_ugoswami@quicinc.com \
--cc=robh+dt@kernel.org \
--cc=selinux@vger.kernel.org \
--cc=serge@hallyn.com \
--cc=simon.horman@corigine.com \
--cc=songmuchun@bytedance.com \
--cc=sstabellini@kernel.org \
--cc=stefanr@s5r6.in-berlin.de \
--cc=steffen.klassert@secunet.com \
--cc=stephen.smalley.work@gmail.com \
--cc=sthemmin@microsoft.com \
--cc=tadeusz.struk@linaro.org \
--cc=tiwai@suse.com \
--cc=trix@redhat.com \
--cc=vincenzo.frascino@arm.com \
--cc=viro@zeniv.linux.org.uk \
--cc=wcn36xx@lists.infradead.org \
--cc=wei.liu@kernel.org \
--cc=xen-devel@lists.xenproject.org \
--cc=xiujianfeng@huawei.com \
--cc=yangyingliang@huawei.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).