linux-hardening - Re: 6.1rc1: NFS memcpy warning on mount

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 17 Oct 2022 11:20:24 +0700
From:   Bagas Sanjaya <bagasdotme@...il.com>
To:     Kees Cook <keescook@...omium.org>
Cc:     Dave Jones <davej@...emonkey.org.uk>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        linux-nfs@...r.kernel.org, linux-hardening@...r.kernel.org,
        Trond Myklebust <trond.myklebust@...merspace.com>,
        Scott Mayhew <smayhew@...hat.com>,
        Anna Schumaker <anna@...nel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: 6.1rc1: NFS memcpy warning on mount

On 10/17/22 11:17, Kees Cook wrote:
> On Mon, Oct 17, 2022 at 10:58:55AM +0700, Bagas Sanjaya wrote:
>> On Sun, Oct 16, 2022 at 10:58:21PM -0400, Dave Jones wrote:
>>> Started getting this during mount on a 6.1rc1 kernel..
>>> not sure which mount it's complaining about, but they're all v3 tcp
>>> mounts on that machine.
>>>
>>> [   19.617475] memcpy: detected field-spanning write (size 28) of single field "request.sap" at fs/nfs/super.c:857 (size 18446744073709551615)
>> [...]
>> Hmm, the blamed line in the warning is introduced by 38465f5d1af932 ("NFS:
>> rename nfs_fs_context pointer arg in a few functions"). Cc: the commit
>> author. Also Cc: Kees for authoring the patch [1] that have fixed
>> similar warning.
> 
> The warning is from commit 54d9469bc515 ("fortify: Add run-time WARN
> for cross-field memcpy()")
> 
>> Also, does v6.0 have this warning? If so, you need to bisect in the range
>> of v6.0..v6.1-rc1.
> 
> No need for bisection -- this is almost certainly a false positive (as
> detailed in the above commit: we're working on purging all of these
> cases from the kernel).
> 
>> [1]: https://lore.kernel.org/lkml/20221011065243.583650-1-keescook@chromium.org/
> 
> Yeah, I have a v2 of this patch, which should also fix this request.sap
> issue. Sending shortly...
> 

OK, thanks!

-- 
An old man doll... just what I always wanted! - Clara