lkml.org 
[lkml]   [2021]   [Jul]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 11/64] net/mlx5e: Avoid field-overflowing memcpy()
    Date
    In preparation for FORTIFY_SOURCE performing compile-time and run-time
    field bounds checking for memcpy(), memmove(), and memset(), avoid
    intentionally writing across neighboring fields.

    Use flexible arrays instead of zero-element arrays (which look like they
    are always overflowing) and split the cross-field memcpy() into two halves
    that can be appropriately bounds-checked by the compiler.

    "pahole" shows no size nor member offset changes to struct mlx5e_tx_wqe
    nor struct mlx5e_umr_wqe. "objdump -d" shows no meaningful object
    code changes (i.e. only source line number induced differences and
    optimizations).

    Signed-off-by: Kees Cook <keescook@chromium.org>
    ---
    drivers/net/ethernet/mellanox/mlx5/core/en.h | 4 ++--
    drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 4 +++-
    2 files changed, 5 insertions(+), 3 deletions(-)

    diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
    index b1b51bbba054..54c014d97db7 100644
    --- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
    +++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
    @@ -204,7 +204,7 @@ static inline int mlx5e_get_max_num_channels(struct mlx5_core_dev *mdev)
    struct mlx5e_tx_wqe {
    struct mlx5_wqe_ctrl_seg ctrl;
    struct mlx5_wqe_eth_seg eth;
    - struct mlx5_wqe_data_seg data[0];
    + struct mlx5_wqe_data_seg data[];
    };

    struct mlx5e_rx_wqe_ll {
    @@ -220,7 +220,7 @@ struct mlx5e_umr_wqe {
    struct mlx5_wqe_ctrl_seg ctrl;
    struct mlx5_wqe_umr_ctrl_seg uctrl;
    struct mlx5_mkey_seg mkc;
    - struct mlx5_mtt inline_mtts[0];
    + struct mlx5_mtt inline_mtts[];
    };

    extern const char mlx5e_self_tests[][ETH_GSTRING_LEN];
    diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
    index 2f0df5cc1a2d..2d2364ea13cf 100644
    --- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
    +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
    @@ -341,8 +341,10 @@ mlx5e_xmit_xdp_frame(struct mlx5e_xdpsq *sq, struct mlx5e_xmit_data *xdptxd,

    /* copy the inline part if required */
    if (sq->min_inline_mode != MLX5_INLINE_MODE_NONE) {
    - memcpy(eseg->inline_hdr.start, xdptxd->data, MLX5E_XDP_MIN_INLINE);
    + memcpy(eseg->inline_hdr.start, xdptxd->data, sizeof(eseg->inline_hdr.start));
    eseg->inline_hdr.sz = cpu_to_be16(MLX5E_XDP_MIN_INLINE);
    + memcpy(dseg, xdptxd->data + sizeof(eseg->inline_hdr.start),
    + MLX5E_XDP_MIN_INLINE - sizeof(eseg->inline_hdr.start));
    dma_len -= MLX5E_XDP_MIN_INLINE;
    dma_addr += MLX5E_XDP_MIN_INLINE;
    dseg++;
    --
    2.30.2
    \
     
     \ /
      Last update: 2021-07-27 23:00    [W:4.304 / U:0.676 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site