Message ID | 20221202212418.never.837-kees@kernel.org |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp1084951wrr; Fri, 2 Dec 2022 13:49:27 -0800 (PST) X-Google-Smtp-Source: AA0mqf48laIqlHhIooB+NMLe3OY8Uulj8G1b3b9AOVGD+PlJiV64lEQmWago1suKDnmZMiscWRym X-Received: by 2002:a17:906:d1cc:b0:7c0:ae21:f1ff with SMTP id bs12-20020a170906d1cc00b007c0ae21f1ffmr8371563ejb.318.1670017766973; Fri, 02 Dec 2022 13:49:26 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1670017766; cv=none; d=google.com; s=arc-20160816; b=m6LmVYsNkR8+lfZO2AZggZwPDIAsriyrRmBeKRTosVS5uC2SBs/QVGN+nkTgIvmABY r11EmGB8mdgi+nd7b9lqpAMBTqgOi7BilPmNvGZBWvhNUic99uloz8zSPWd0i8rhw7gi Mmn8WCQ1DwnKWhrzaZ751Nt1+nzYMjSOt5UvBl9xlzHFWAchhuWqla8Y6lyl2VqFZZ05 C5xO6srhSFvK1mvN6Lg+8COfQmHjdi8vz4S8cICvpGvH2ADFOdXIdZHtkYzzebwqHnDL NhAmz7pyyb5Xdz2FB1Y66dlSmzGsg3X2OHx1koBtqZWd8GOmXOu6H5rVrAYcy/cJPOOu y6wA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=12aQYv6pNDlz3kqQzWKO2uUnIoYw8k+CG7RR/rv2kas=; b=a90eLAL8NCO5ujhxoaVz3ASmlpY3bhqhoMDLB8P1TpCC6gF2SeUJ2WT0cm05K9aFlD qzs3rpy+zpvtMRu1nn7pY9foPddRIGJ1gKeyZHo/+AjNF25Viq3uHcQJOaXmTcjCuyPT EjZzTvygGeuE2oye4gcrXmqMMofzjfuECaI1thGfGzxyoYg2zQHex4R16wPB66J3Cwd9 5FEpVDD79qjV75u/VTR5Kr5SKDqvahOpludx6FKNYQgdZwCkR6QQYH0shxq/Z/SS9Iu9 ZpN0FWtQlTwTao96ylJrXrUlhEQWQUk+aGRCwkY4nZRGiOPT7TpXREdKbvSmVnhVgnL0 7atA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=T74PGYDh; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id t16-20020a056402525000b0046ac017b01bsi830425edd.324.2022.12.02.13.49.03; Fri, 02 Dec 2022 13:49:26 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=T74PGYDh; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234329AbiLBVY2 (ORCPT <rfc822;lhua1029@gmail.com> + 99 others); Fri, 2 Dec 2022 16:24:28 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38114 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229500AbiLBVY0 (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Fri, 2 Dec 2022 16:24:26 -0500 Received: from mail-pg1-x535.google.com (mail-pg1-x535.google.com [IPv6:2607:f8b0:4864:20::535]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6C30D92FE8 for <linux-kernel@vger.kernel.org>; Fri, 2 Dec 2022 13:24:25 -0800 (PST) Received: by mail-pg1-x535.google.com with SMTP id w37so5383559pga.5 for <linux-kernel@vger.kernel.org>; Fri, 02 Dec 2022 13:24:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=12aQYv6pNDlz3kqQzWKO2uUnIoYw8k+CG7RR/rv2kas=; b=T74PGYDhKiQHFX1rUbRIOiCv4vz6iGaOnC7K9ErdB1BzmUXvCH/1kx1QXL4c6ieoZX 21PDT5faUpOfudcVt38fnDW7vDITh8I2bKWFIbpNHm1D2uypViY1q6E/jYtk4TBq/3X+ 1NhpdIBX6KQwlDjZbZZFFud2SzjQaT2z58vqU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=12aQYv6pNDlz3kqQzWKO2uUnIoYw8k+CG7RR/rv2kas=; b=NLVeI22EiSteYK3927v6ldaWzIqBIw613SW+OCyz87X2DBQR/q4o7Nh/fHx57OIeug xsQvVzfOG1xBJtHbjHmMB4GJtJgvXIHUvlV/GyquzeAPFEMf0ozo4EZzpXMSL9GKCFcI W0X8wA7DfK3m3dl6b++jlqvF4b1r3r5eHS9FVbIS+hS7g1JTw4F65LpCPETZeOFtdqKO FIIoO9ZitoyvUHzxWVgZDIyQAa8OCZMu1ND9gZebA6lGltAa8mvFLNXlKfTJ9L7Utt/j uyOd5X55Qdx1GaTOTjDoSeqzNTYNNNkLjo7klAEwcU+aTx3myeID3t6sw6LG+DHbNNoa vKsQ== X-Gm-Message-State: ANoB5pncc+UJAss+DABazY5/nTEnt0t/4B+dYuI3jDA9DCZilqDQyxtz 9UidFIahTYoUQwjKDzmLdEZgnQ== X-Received: by 2002:aa7:9416:0:b0:575:518e:dc11 with SMTP id x22-20020aa79416000000b00575518edc11mr23821532pfo.86.1670016264915; Fri, 02 Dec 2022 13:24:24 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id i29-20020a056a00005d00b0056b6c7a17c6sm5695671pfk.12.2022.12.02.13.24.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 02 Dec 2022 13:24:24 -0800 (PST) From: Kees Cook <keescook@chromium.org> To: Samuel Mendoza-Jonas <sam@mendozajonas.com> Cc: Kees Cook <keescook@chromium.org>, Joel Stanley <joel@jms.id.au>, "David S. Miller" <davem@davemloft.net>, Eric Dumazet <edumazet@google.com>, Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH] net/ncsi: Silence runtime memcpy() false positive warning Date: Fri, 2 Dec 2022 13:24:22 -0800 Message-Id: <20221202212418.never.837-kees@kernel.org> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1371; h=from:subject:message-id; bh=2sUnLG3FFN8pFif3YWCnaOEtrm0LjtacXGcVGEiw/+Y=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBjim0FA4ytswXqmWp1hRMca/r2avtZHR15euW2n+B3 jQs7mISJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCY4ptBQAKCRCJcvTf3G3AJpzCD/ 9E+a3vKrpcpU0BDeu4dr57dQgQ9SeaSG2Ag/XejMzr19dmuMerdXl6P1NqOmAWo7UYt/D4qId4z3Hp X7E/W5FiDu3uI/Bt2w1ibs7eZ0HcN5Uvu059rx1xAkoiryxEICiHyrHuXyCL622b3Dph3tyPjFTpbJ vl7cDe374WWh8g1Drj90IaHF7ZNq7ZpzJU+EL+/DseIcncBX5KMoNH8bcOqnKCfLhp0Rn+cRE2oOWP GocayW8y41PU4VijiPtVY+NPP86UOKTvko6/5mIlOudbLFUm39KlmXEkdxAHiZUK5wg0OJ56uXnSv0 8OMxyQoFPjmZe7Pw/UErnIxW/ReOejRN6mVzDFV8r12CXTwzSqfFGgzUfep1o6HVoRKSrun+eA9dxR +6iRUGEp0uDIFIDHPJoZvmMC3VGzvxT6krGxWgMOYB8bNUOTjkNkp6iheICNV4sk8OUCoIJzSKZYDY g5STXOgCghnpRCfC4jGxQsSAxRsqlurLMP2ej83Q0ExoR+U1E7dCG/vnxQMrZnb33q2vGyWUwuVdoS ujQgFyXD1gqgQmeBE2BlbEuLkCeLHJLT5gAypd9TnZ6aVe8SQ6d5sHFPQbc4ZAO0MrgPo2Yv3l0t1d VREmX/tud/ODKGuWxensvuZM9kgb3XFccEt8oeVwHZiFZ4L9xCx+yJ9Vhopg== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1751140550488647504?= X-GMAIL-MSGID: =?utf-8?q?1751140550488647504?= |
Series |
net/ncsi: Silence runtime memcpy() false positive warning
|
|
Commit Message
Kees Cook
Dec. 2, 2022, 9:24 p.m. UTC
The memcpy() in ncsi_cmd_handler_oem deserializes nca->data into a
flexible array structure that overlapping with non-flex-array members
(mfr_id) intentionally. Since the mem_to_flex() API is not finished,
temporarily silence this warning, since it is a false positive, using
unsafe_memcpy().
Reported-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/netdev/CACPK8Xdfi=OJKP0x0D1w87fQeFZ4A2DP2qzGCRcuVbpU-9=4sQ@mail.gmail.com/
Cc: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
---
net/ncsi/ncsi-cmd.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
Comments
Hello, On Fri, 2022-12-02 at 13:24 -0800, Kees Cook wrote: > The memcpy() in ncsi_cmd_handler_oem deserializes nca->data into a > flexible array structure that overlapping with non-flex-array members > (mfr_id) intentionally. Since the mem_to_flex() API is not finished, > temporarily silence this warning, since it is a false positive, using > unsafe_memcpy(). > > Reported-by: Joel Stanley <joel@jms.id.au> > Link: https://lore.kernel.org/netdev/CACPK8Xdfi=OJKP0x0D1w87fQeFZ4A2DP2qzGCRcuVbpU-9=4sQ@mail.gmail.com/ > Cc: Samuel Mendoza-Jonas <sam@mendozajonas.com> > Cc: "David S. Miller" <davem@davemloft.net> > Cc: Eric Dumazet <edumazet@google.com> > Cc: Jakub Kicinski <kuba@kernel.org> > Cc: Paolo Abeni <pabeni@redhat.com> > Cc: netdev@vger.kernel.org > Signed-off-by: Kees Cook <keescook@chromium.org> Is this for the -net or the -net-next tree? It applies to both... It you are targetting the -net tree, I think it would be nicer adding a suitable Fixes tag. Thanks! Paolo
On Tue, Dec 06, 2022 at 11:36:54AM +0100, Paolo Abeni wrote: > Hello, > > On Fri, 2022-12-02 at 13:24 -0800, Kees Cook wrote: > > The memcpy() in ncsi_cmd_handler_oem deserializes nca->data into a > > flexible array structure that overlapping with non-flex-array members > > (mfr_id) intentionally. Since the mem_to_flex() API is not finished, > > temporarily silence this warning, since it is a false positive, using > > unsafe_memcpy(). > > > > Reported-by: Joel Stanley <joel@jms.id.au> > > Link: https://lore.kernel.org/netdev/CACPK8Xdfi=OJKP0x0D1w87fQeFZ4A2DP2qzGCRcuVbpU-9=4sQ@mail.gmail.com/ > > Cc: Samuel Mendoza-Jonas <sam@mendozajonas.com> > > Cc: "David S. Miller" <davem@davemloft.net> > > Cc: Eric Dumazet <edumazet@google.com> > > Cc: Jakub Kicinski <kuba@kernel.org> > > Cc: Paolo Abeni <pabeni@redhat.com> > > Cc: netdev@vger.kernel.org > > Signed-off-by: Kees Cook <keescook@chromium.org> > > Is this for the -net or the -net-next tree? It applies to both... > > It you are targetting the -net tree, I think it would be nicer adding a > suitable Fixes tag. -net-next (v6.2) is fine -- this is where the warning manifests. -Kees
Hello: This patch was applied to netdev/net-next.git (master) by Jakub Kicinski <kuba@kernel.org>: On Fri, 2 Dec 2022 13:24:22 -0800 you wrote: > The memcpy() in ncsi_cmd_handler_oem deserializes nca->data into a > flexible array structure that overlapping with non-flex-array members > (mfr_id) intentionally. Since the mem_to_flex() API is not finished, > temporarily silence this warning, since it is a false positive, using > unsafe_memcpy(). > > Reported-by: Joel Stanley <joel@jms.id.au> > Link: https://lore.kernel.org/netdev/CACPK8Xdfi=OJKP0x0D1w87fQeFZ4A2DP2qzGCRcuVbpU-9=4sQ@mail.gmail.com/ > Cc: Samuel Mendoza-Jonas <sam@mendozajonas.com> > Cc: "David S. Miller" <davem@davemloft.net> > Cc: Eric Dumazet <edumazet@google.com> > Cc: Jakub Kicinski <kuba@kernel.org> > Cc: Paolo Abeni <pabeni@redhat.com> > Cc: netdev@vger.kernel.org > Signed-off-by: Kees Cook <keescook@chromium.org> > > [...] Here is the summary with links: - net/ncsi: Silence runtime memcpy() false positive warning https://git.kernel.org/netdev/net-next/c/b93884eea26f You are awesome, thank you!
On Fri, 2 Dec 2022 at 21:24, Kees Cook <keescook@chromium.org> wrote: > > The memcpy() in ncsi_cmd_handler_oem deserializes nca->data into a > flexible array structure that overlapping with non-flex-array members > (mfr_id) intentionally. Since the mem_to_flex() API is not finished, > temporarily silence this warning, since it is a false positive, using > unsafe_memcpy(). Thanks for sending the fix Kees. I got a bit busy towards the end of the year. I spent some time looking at how the netlink api was used, and tried to convince myself that a user couldn't send an OEM command that triggered the overflow. It all got a bit tangled up so I didn't come to a conclusion. Cheers, Joel > > Reported-by: Joel Stanley <joel@jms.id.au> > Link: https://lore.kernel.org/netdev/CACPK8Xdfi=OJKP0x0D1w87fQeFZ4A2DP2qzGCRcuVbpU-9=4sQ@mail.gmail.com/ > Cc: Samuel Mendoza-Jonas <sam@mendozajonas.com> > Cc: "David S. Miller" <davem@davemloft.net> > Cc: Eric Dumazet <edumazet@google.com> > Cc: Jakub Kicinski <kuba@kernel.org> > Cc: Paolo Abeni <pabeni@redhat.com> > Cc: netdev@vger.kernel.org > Signed-off-by: Kees Cook <keescook@chromium.org> > --- > net/ncsi/ncsi-cmd.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/net/ncsi/ncsi-cmd.c b/net/ncsi/ncsi-cmd.c > index dda8b76b7798..fd2236ee9a79 100644 > --- a/net/ncsi/ncsi-cmd.c > +++ b/net/ncsi/ncsi-cmd.c > @@ -228,7 +228,8 @@ static int ncsi_cmd_handler_oem(struct sk_buff *skb, > len += max(payload, padding_bytes); > > cmd = skb_put_zero(skb, len); > - memcpy(&cmd->mfr_id, nca->data, nca->payload); > + unsafe_memcpy(&cmd->mfr_id, nca->data, nca->payload, > + /* skb allocated with enough to load the payload */); > ncsi_cmd_build_header(&cmd->cmd.common, nca); > > return 0; > -- > 2.34.1 >
diff --git a/net/ncsi/ncsi-cmd.c b/net/ncsi/ncsi-cmd.c index dda8b76b7798..fd2236ee9a79 100644 --- a/net/ncsi/ncsi-cmd.c +++ b/net/ncsi/ncsi-cmd.c @@ -228,7 +228,8 @@ static int ncsi_cmd_handler_oem(struct sk_buff *skb, len += max(payload, padding_bytes); cmd = skb_put_zero(skb, len); - memcpy(&cmd->mfr_id, nca->data, nca->payload); + unsafe_memcpy(&cmd->mfr_id, nca->data, nca->payload, + /* skb allocated with enough to load the payload */); ncsi_cmd_build_header(&cmd->cmd.common, nca); return 0;