linux-hardening - Re: [PATCH v2] NFS: Avoid memcpy() run-time warning for struct sockaddr overflows

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 27 Oct 2022 00:03:07 +0000
From:   Trond Myklebust <trondmy@...merspace.com>
To:     Kees Cook <keescook@...omium.org>, Anna Schumaker <anna@...nel.org>
CC:     kernel test robot <yujie.liu@...el.com>,
        Linux NFS Mailing List <linux-nfs@...r.kernel.org>,
        Dave Jones <davej@...emonkey.org.uk>,
        Bagas Sanjaya <bagasdotme@...il.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-hardening@...r.kernel.org" <linux-hardening@...r.kernel.org>
Subject: Re: [PATCH v2] NFS: Avoid memcpy() run-time warning for struct
 sockaddr overflows



> On Oct 26, 2022, at 19:32, Kees Cook <keescook@...omium.org> wrote:
> 
> On Sun, Oct 16, 2022 at 09:36:50PM -0700, Kees Cook wrote:
>> The 'nfs_server' and 'mount_server' structures include a union of
>> 'struct sockaddr' (with the older 16 bytes max address size) and
>> 'struct sockaddr_storage' which is large enough to hold all the
>> supported sa_family types (128 bytes max size). The runtime memcpy()
>> buffer overflow checker is seeing attempts to write beyond the 16
>> bytes as an overflow, but the actual expected size is that of 'struct
>> sockaddr_storage'. Plumb the use of 'struct sockaddr_storage' more
>> completely through-out NFS, which results in adjusting the memcpy()
>> buffers to the correct union members. Avoids this false positive run-time
>> warning under CONFIG_FORTIFY_SOURCE:
>> 
>>  memcpy: detected field-spanning write (size 28) of single field "&ctx->nfs_server.address" at fs/nfs/namespace.c:178 (size 16)
>> 
>> Reported-by: kernel test robot <yujie.liu@...el.com>
>> Link: https://lore.kernel.org/all/202210110948.26b43120-yujie.liu@intel.com
>> Cc: Trond Myklebust <trond.myklebust@...merspace.com>
>> Cc: Anna Schumaker <anna@...nel.org>
> 
> Friendly ping -- this needs to land in v6.1 to avoid these warnings.
> Should I carry this in the hardening tree instead?
> 
> Thanks!

Anna, this is your call since you’re the ‘6.1 nfs client maintainer’...


_________________________________
Trond Myklebust
Linux NFS client maintainer, Hammerspace
trond.myklebust@...merspace.com