lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 20 Oct 2022 10:58:50 +0200 From: Paolo Abeni <pabeni@...hat.com> To: Kees Cook <keescook@...omium.org>, Jakub Kicinski <kuba@...nel.org> Cc: "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Jens Axboe <axboe@...nel.dk>, Pavel Begunkov <asml.silence@...il.com>, David Ahern <dsahern@...nel.org>, Dylan Yudaken <dylany@...com>, Yajun Deng <yajun.deng@...ux.dev>, Petr Machata <petrm@...dia.com>, Hangbin Liu <liuhangbin@...il.com>, Leon Romanovsky <leon@...nel.org>, syzbot <syzkaller@...glegroups.com>, Willem de Bruijn <willemb@...gle.com>, Pablo Neira Ayuso <pablo@...filter.org>, netdev@...r.kernel.org, Nathan Chancellor <nathan@...nel.org>, Nick Desaulniers <ndesaulniers@...gle.com>, Tom Rix <trix@...hat.com>, "D. Wythe" <alibuda@...ux.alibaba.com>, Jeremy Kerr <jk@...econstruct.com.au>, Sebastian Andrzej Siewior <bigeasy@...utronix.de>, Menglong Dong <imagedong@...cent.com>, Kuniyuki Iwashima <kuniyu@...zon.com>, Congyu Liu <liu3101@...due.edu>, Wolfram Sang <wsa+renesas@...g-engineering.com>, Ziyang Xuan <william.xuanziyang@...wei.com>, linux-kernel@...r.kernel.org, llvm@...ts.linux.dev, linux-hardening@...r.kernel.org Subject: Re: [PATCH][next] net: dev: Convert sa_data to flexible array in struct sockaddr Hello, On Tue, 2022-10-18 at 02:56 -0700, Kees Cook wrote: > One of the worst offenders of "fake flexible arrays" is struct sockaddr, > as it is the classic example of why GCC and Clang have been traditionally > forced to treat all trailing arrays as fake flexible arrays: in the > distant misty past, sa_data became too small, and code started just > treating it as a flexible array, even though it was fixed-size. The > special case by the compiler is specifically that sizeof(sa->sa_data) > and FORTIFY_SOURCE (which uses __builtin_object_size(sa->sa_data, 1)) > do not agree (14 and -1 respectively), which makes FORTIFY_SOURCE treat > it as a flexible array. > > However, the coming -fstrict-flex-arrays compiler flag will remove > these special cases so that FORTIFY_SOURCE can gain coverage over all > the trailing arrays in the kernel that are _not_ supposed to be treated > as a flexible array. To deal with this change, convert sa_data to a true > flexible array. To keep the structure size the same, move sa_data into > a union with a newly introduced sa_data_min with the original size. The > result is that FORTIFY_SOURCE can continue to have no idea how large > sa_data may actually be, but anything using sizeof(sa->sa_data) must > switch to sizeof(sa->sa_data_min). > > Cc: Jakub Kicinski <kuba@...nel.org> > Cc: "David S. Miller" <davem@...emloft.net> > Cc: Eric Dumazet <edumazet@...gle.com> > Cc: Paolo Abeni <pabeni@...hat.com> > Cc: Jens Axboe <axboe@...nel.dk> > Cc: Pavel Begunkov <asml.silence@...il.com> > Cc: David Ahern <dsahern@...nel.org> > Cc: Dylan Yudaken <dylany@...com> > Cc: Yajun Deng <yajun.deng@...ux.dev> > Cc: Petr Machata <petrm@...dia.com> > Cc: Hangbin Liu <liuhangbin@...il.com> > Cc: Leon Romanovsky <leon@...nel.org> > Cc: syzbot <syzkaller@...glegroups.com> > Cc: Willem de Bruijn <willemb@...gle.com> > Cc: Pablo Neira Ayuso <pablo@...filter.org> > Cc: netdev@...r.kernel.org > Signed-off-by: Kees Cook <keescook@...omium.org> > --- > include/linux/socket.h | 5 ++++- > net/core/dev.c | 2 +- > net/core/dev_ioctl.c | 2 +- > net/packet/af_packet.c | 10 +++++----- > 4 files changed, 11 insertions(+), 8 deletions(-) > > diff --git a/include/linux/socket.h b/include/linux/socket.h > index de3701a2a212..13c3a237b9c9 100644 > --- a/include/linux/socket.h > +++ b/include/linux/socket.h > @@ -33,7 +33,10 @@ typedef __kernel_sa_family_t sa_family_t; > > struct sockaddr { > sa_family_t sa_family; /* address family, AF_xxx */ > - char sa_data[14]; /* 14 bytes of protocol address */ > + union { > + char sa_data_min[14]; /* Minimum 14 bytes of protocol address */ > + DECLARE_FLEX_ARRAY(char, sa_data); Any special reason to avoid preserving the old name for the array and e.g. using sa_data_flex for the new field, so we don't have to touch the sockaddr users? Thanks! Paolo
Powered by blists - more mailing lists