lkml.org 
[lkml]   [2021]   [Sep]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.13 063/219] ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs()
    Date
    From: "Gustavo A. R. Silva" <gustavoars@kernel.org>

    [ Upstream commit 6321c7acb82872ef6576c520b0e178eaad3a25c0 ]

    Fix the following out-of-bounds warning:

    In function 'ip_copy_addrs',
    inlined from '__ip_queue_xmit' at net/ipv4/ip_output.c:517:2:
    net/ipv4/ip_output.c:449:2: warning: 'memcpy' offset [40, 43] from the object at 'fl' is out of the bounds of referenced subobject 'saddr' with type 'unsigned int' at offset 36 [-Warray-bounds]
    449 | memcpy(&iph->saddr, &fl4->saddr,
    | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    450 | sizeof(fl4->saddr) + sizeof(fl4->daddr));
    | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    The problem is that the original code is trying to copy data into a
    couple of struct members adjacent to each other in a single call to
    memcpy(). This causes a legitimate compiler warning because memcpy()
    overruns the length of &iph->saddr and &fl4->saddr. As these are just
    a couple of struct members, fix this by using direct assignments,
    instead of memcpy().

    This helps with the ongoing efforts to globally enable -Warray-bounds
    and get us closer to being able to tighten the FORTIFY_SOURCE routines
    on memcpy().

    Link: https://github.com/KSPP/linux/issues/109
    Reported-by: kernel test robot <lkp@intel.com>
    Link: https://lore.kernel.org/lkml/d5ae2e65-1f18-2577-246f-bada7eee6ccd@intel.com/
    Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/ipv4/ip_output.c | 5 +++--
    1 file changed, 3 insertions(+), 2 deletions(-)

    diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
    index 8d8a8da3ae7e..a202dcec0dc2 100644
    --- a/net/ipv4/ip_output.c
    +++ b/net/ipv4/ip_output.c
    @@ -446,8 +446,9 @@ static void ip_copy_addrs(struct iphdr *iph, const struct flowi4 *fl4)
    {
    BUILD_BUG_ON(offsetof(typeof(*fl4), daddr) !=
    offsetof(typeof(*fl4), saddr) + sizeof(fl4->saddr));
    - memcpy(&iph->saddr, &fl4->saddr,
    - sizeof(fl4->saddr) + sizeof(fl4->daddr));
    +
    + iph->saddr = fl4->saddr;
    + iph->daddr = fl4->daddr;
    }

    /* Note: skb->sk can be different from sk, in case of tunnels */
    --
    2.30.2
    \
     
     \ /
      Last update: 2021-09-09 14:15    [W:4.334 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site