[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <202210261726.554CBDC55@keescook>
Date: Wed, 26 Oct 2022 17:26:58 -0700
From: Kees Cook <keescook@...omium.org>
To: Anna Schumaker <anna@...nel.org>
Cc: Trond Myklebust <trondmy@...merspace.com>,
kernel test robot <yujie.liu@...el.com>,
Linux NFS Mailing List <linux-nfs@...r.kernel.org>,
Dave Jones <davej@...emonkey.org.uk>,
Bagas Sanjaya <bagasdotme@...il.com>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
"linux-hardening@...r.kernel.org" <linux-hardening@...r.kernel.org>
Subject: Re: [PATCH v2] NFS: Avoid memcpy() run-time warning for struct
sockaddr overflows
On Thu, Oct 27, 2022 at 12:03:07AM +0000, Trond Myklebust wrote:
>
>
> > On Oct 26, 2022, at 19:32, Kees Cook <keescook@...omium.org> wrote:
> >
> > On Sun, Oct 16, 2022 at 09:36:50PM -0700, Kees Cook wrote:
> >> The 'nfs_server' and 'mount_server' structures include a union of
> >> 'struct sockaddr' (with the older 16 bytes max address size) and
> >> 'struct sockaddr_storage' which is large enough to hold all the
> >> supported sa_family types (128 bytes max size). The runtime memcpy()
> >> buffer overflow checker is seeing attempts to write beyond the 16
> >> bytes as an overflow, but the actual expected size is that of 'struct
> >> sockaddr_storage'. Plumb the use of 'struct sockaddr_storage' more
> >> completely through-out NFS, which results in adjusting the memcpy()
> >> buffers to the correct union members. Avoids this false positive run-time
> >> warning under CONFIG_FORTIFY_SOURCE:
> >>
> >> memcpy: detected field-spanning write (size 28) of single field "&ctx->nfs_server.address" at fs/nfs/namespace.c:178 (size 16)
> >>
> >> Reported-by: kernel test robot <yujie.liu@...el.com>
> >> Link: https://lore.kernel.org/all/202210110948.26b43120-yujie.liu@intel.com
> >> Cc: Trond Myklebust <trond.myklebust@...merspace.com>
> >> Cc: Anna Schumaker <anna@...nel.org>
> >
> > Friendly ping -- this needs to land in v6.1 to avoid these warnings.
> > Should I carry this in the hardening tree instead?
> >
> > Thanks!
>
> Anna, this is your call since you’re the ‘6.1 nfs client maintainer’...
And just to remind, this came up in -rc1 as well:
https://lore.kernel.org/lkml/202210162144.76FBC7271@keescook/
--
Kees Cook
Powered by blists - more mailing lists