lkml.org 
[lkml]   [2021]   [Jul]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 38/64] xfrm: Use memset_after() to clear padding
    Date
    In preparation for FORTIFY_SOURCE performing compile-time and run-time
    field bounds checking for memset(), avoid intentionally writing across
    neighboring fields.

    Clear trailing padding bytes using the new helper so that memset()
    doesn't get confused about writing "past the end" of the last struct
    member. There is no change to the resulting machine code.

    Signed-off-by: Kees Cook <keescook@chromium.org>
    ---
    net/xfrm/xfrm_policy.c | 4 +---
    net/xfrm/xfrm_user.c | 2 +-
    2 files changed, 2 insertions(+), 4 deletions(-)

    diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
    index 37d17a79617c..1a06585022ab 100644
    --- a/net/xfrm/xfrm_policy.c
    +++ b/net/xfrm/xfrm_policy.c
    @@ -2486,9 +2486,7 @@ static inline struct xfrm_dst *xfrm_alloc_dst(struct net *net, int family)
    xdst = dst_alloc(dst_ops, NULL, 1, DST_OBSOLETE_NONE, 0);

    if (likely(xdst)) {
    - struct dst_entry *dst = &xdst->u.dst;
    -
    - memset(dst + 1, 0, sizeof(*xdst) - sizeof(*dst));
    + memset_after(xdst, 0, u.dst);
    } else
    xdst = ERR_PTR(-ENOBUFS);

    diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
    index acc3a0dab331..0bf8fec3fd97 100644
    --- a/net/xfrm/xfrm_user.c
    +++ b/net/xfrm/xfrm_user.c
    @@ -2907,7 +2907,7 @@ static int build_expire(struct sk_buff *skb, struct xfrm_state *x, const struct
    copy_to_user_state(x, &ue->state);
    ue->hard = (c->data.hard != 0) ? 1 : 0;
    /* clear the padding bytes */
    - memset(&ue->hard + 1, 0, sizeof(*ue) - offsetofend(typeof(*ue), hard));
    + memset_after(ue, 0, hard);

    err = xfrm_mark_put(skb, &x->mark);
    if (err)
    --
    2.30.2
    \
     
     \ /
      Last update: 2021-07-27 23:07    [W:7.407 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site