linux-kernel - Re: [PATCH 07/15] drop_monitor: work around gcc-10 stringop-overflow warning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 1 May 2020 07:28:14 -0400
From:   Neil Horman <nhorman@...driver.com>
To:     Arnd Bergmann <arnd@...db.de>
Cc:     linux-kernel@...r.kernel.org,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Ido Schimmel <idosch@...lanox.com>,
        Jiri Pirko <jiri@...lanox.com>, Joe Perches <joe@...ches.com>,
        netdev@...r.kernel.org
Subject: Re: [PATCH 07/15] drop_monitor: work around gcc-10 stringop-overflow
 warning

On Thu, Apr 30, 2020 at 11:30:49PM +0200, Arnd Bergmann wrote:
> The current gcc-10 snapshot produces a false-positive warning:
> 
> net/core/drop_monitor.c: In function 'trace_drop_common.constprop':
> cc1: error: writing 8 bytes into a region of size 0 [-Werror=stringop-overflow=]
> In file included from net/core/drop_monitor.c:23:
> include/uapi/linux/net_dropmon.h:36:8: note: at offset 0 to object 'entries' with size 4 declared here
>    36 |  __u32 entries;
>       |        ^~~~~~~
> 
> I reported this in the gcc bugzilla, but in case it does not get
> fixed in the release, work around it by using a temporary variable.
> 
> Fixes: 9a8afc8d3962 ("Network Drop Monitor: Adding drop monitor implementation & Netlink protocol")
> Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94881
> Signed-off-by: Arnd Bergmann <arnd@...db.de>
> ---
>  net/core/drop_monitor.c | 11 +++++++----
>  1 file changed, 7 insertions(+), 4 deletions(-)
> 
> diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
> index 8e33cec9fc4e..2ee7bc4c9e03 100644
> --- a/net/core/drop_monitor.c
> +++ b/net/core/drop_monitor.c
> @@ -213,6 +213,7 @@ static void sched_send_work(struct timer_list *t)
>  static void trace_drop_common(struct sk_buff *skb, void *location)
>  {
>  	struct net_dm_alert_msg *msg;
> +	struct net_dm_drop_point *point;
>  	struct nlmsghdr *nlh;
>  	struct nlattr *nla;
>  	int i;
> @@ -231,11 +232,13 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
>  	nlh = (struct nlmsghdr *)dskb->data;
>  	nla = genlmsg_data(nlmsg_data(nlh));
>  	msg = nla_data(nla);
> +	point = msg->points;
>  	for (i = 0; i < msg->entries; i++) {
> -		if (!memcmp(&location, msg->points[i].pc, sizeof(void *))) {
> -			msg->points[i].count++;
> +		if (!memcmp(&location, &point->pc, sizeof(void *))) {
> +			point->count++;
>  			goto out;
>  		}
> +		point++;
>  	}
>  	if (msg->entries == dm_hit_limit)
>  		goto out;
> @@ -244,8 +247,8 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
>  	 */
>  	__nla_reserve_nohdr(dskb, sizeof(struct net_dm_drop_point));
>  	nla->nla_len += NLA_ALIGN(sizeof(struct net_dm_drop_point));
> -	memcpy(msg->points[msg->entries].pc, &location, sizeof(void *));
> -	msg->points[msg->entries].count = 1;
> +	memcpy(point->pc, &location, sizeof(void *));
> +	point->count = 1;
>  	msg->entries++;
>  
>  	if (!timer_pending(&data->send_timer)) {
Acked-by: Neil Horman <nhorman@...driver.com>