lkml.org 
[lkml]   [2021]   [Sep]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.9 19/48] flow_dissector: Fix out-of-bounds warnings
    Date
    From: "Gustavo A. R. Silva" <gustavoars@kernel.org>

    [ Upstream commit 323e0cb473e2a8706ff162b6b4f4fa16023c9ba7 ]

    Fix the following out-of-bounds warnings:

    net/core/flow_dissector.c: In function '__skb_flow_dissect':
    >> net/core/flow_dissector.c:1104:4: warning: 'memcpy' offset [24, 39] from the object at '<unknown>' is out of the bounds of referenced subobject 'saddr' with type 'struct in6_addr' at offset 8 [-Warray-bounds]
    1104 | memcpy(&key_addrs->v6addrs, &iph->saddr,
    | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    1105 | sizeof(key_addrs->v6addrs));
    | ~~~~~~~~~~~~~~~~~~~~~~~~~~~
    In file included from include/linux/ipv6.h:5,
    from net/core/flow_dissector.c:6:
    include/uapi/linux/ipv6.h:133:18: note: subobject 'saddr' declared here
    133 | struct in6_addr saddr;
    | ^~~~~
    >> net/core/flow_dissector.c:1059:4: warning: 'memcpy' offset [16, 19] from the object at '<unknown>' is out of the bounds of referenced subobject 'saddr' with type 'unsigned int' at offset 12 [-Warray-bounds]
    1059 | memcpy(&key_addrs->v4addrs, &iph->saddr,
    | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    1060 | sizeof(key_addrs->v4addrs));
    | ~~~~~~~~~~~~~~~~~~~~~~~~~~~
    In file included from include/linux/ip.h:17,
    from net/core/flow_dissector.c:5:
    include/uapi/linux/ip.h:103:9: note: subobject 'saddr' declared here
    103 | __be32 saddr;
    | ^~~~~

    The problem is that the original code is trying to copy data into a
    couple of struct members adjacent to each other in a single call to
    memcpy(). So, the compiler legitimately complains about it. As these
    are just a couple of members, fix this by copying each one of them in
    separate calls to memcpy().

    This helps with the ongoing efforts to globally enable -Warray-bounds
    and get us closer to being able to tighten the FORTIFY_SOURCE routines
    on memcpy().

    Link: https://github.com/KSPP/linux/issues/109
    Reported-by: kernel test robot <lkp@intel.com>
    Link: https://lore.kernel.org/lkml/d5ae2e65-1f18-2577-246f-bada7eee6ccd@intel.com/
    Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/core/flow_dissector.c | 12 ++++++++----
    1 file changed, 8 insertions(+), 4 deletions(-)

    diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
    index 26b0f70d2f1c..6b04cbd00842 100644
    --- a/net/core/flow_dissector.c
    +++ b/net/core/flow_dissector.c
    @@ -176,8 +176,10 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
    FLOW_DISSECTOR_KEY_IPV4_ADDRS,
    target_container);

    - memcpy(&key_addrs->v4addrs, &iph->saddr,
    - sizeof(key_addrs->v4addrs));
    + memcpy(&key_addrs->v4addrs.src, &iph->saddr,
    + sizeof(key_addrs->v4addrs.src));
    + memcpy(&key_addrs->v4addrs.dst, &iph->daddr,
    + sizeof(key_addrs->v4addrs.dst));
    key_control->addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
    }

    @@ -216,8 +218,10 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
    FLOW_DISSECTOR_KEY_IPV6_ADDRS,
    target_container);

    - memcpy(&key_addrs->v6addrs, &iph->saddr,
    - sizeof(key_addrs->v6addrs));
    + memcpy(&key_addrs->v6addrs.src, &iph->saddr,
    + sizeof(key_addrs->v6addrs.src));
    + memcpy(&key_addrs->v6addrs.dst, &iph->daddr,
    + sizeof(key_addrs->v6addrs.dst));
    key_control->addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
    }

    --
    2.30.2

    \
     
     \ /
      Last update: 2021-09-09 15:33    [W:3.073 / U:0.476 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site