linux-kernel - Re: 6.1rc1: NFS memcpy warning on mount

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 16 Oct 2022 21:57:59 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Dave Jones <davej@...emonkey.org.uk>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Trond Myklebust <trond.myklebust@...merspace.com>,
        Anna Schumaker <anna@...nel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: 6.1rc1: NFS memcpy warning on mount

On Sun, Oct 16, 2022 at 10:58:21PM -0400, Dave Jones wrote:
> [   19.617475] memcpy: detected field-spanning write (size 28) of single field "request.sap" at fs/nfs/super.c:857 (size 18446744073709551615)

I've sent this, which should fix it:
https://lore.kernel.org/lkml/20221017043107.never.457-kees@kernel.org/

However, the -1 size tells me something has gone slightly wrong with the
runtime warning, as it _should_ be ignoring destinations with "unknown"
size -- in this case, struct sockaddr has a trailing array, which is
treated (currently) as a fake flexible array, so __builtin_object_size()
is reporting the "-1". But with the coming -fstrict-flex-arrays, this
will need fixing anyway. I will re-check the runtime warning logic...

-- 
Kees Cook