linux-kernel - Re: [PATCH v2] [next] pcmcia: synclink_cs: replace 1-element array with flex-array member

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 15 Dec 2022 09:19:57 +1300
From:   Paulo Miguel Almeida <paulo.miguel.almeida.rodenas@...il.com>
To:     Andy Shevchenko <andy.shevchenko@...il.com>
Cc:     Arnd Bergmann <arnd@...db.de>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Ilpo Järvinen <ilpo.jarvinen@...ux.intel.com>,
        Jiri Slaby <jirislaby@...nel.org>,
        Haowen Bai <baihaowen@...zu.com>, linux-kernel@...r.kernel.org,
        linux-hardening@...r.kernel.org,
        paulo.miguel.almeida.rodenas@...il.com
Subject: Re: [PATCH v2] [next] pcmcia: synclink_cs: replace 1-element array
 with flex-array member

On Wed, Dec 14, 2022 at 12:43:48PM +0200, Andy Shevchenko wrote:
> On Wed, Dec 14, 2022 at 10:58 AM Paulo Miguel Almeida
> <paulo.miguel.almeida.rodenas@...il.com> wrote:
> >
> > One-element arrays are deprecated, and we are replacing them with
> > flexible array members instead. So, replace one-element array with
> > flexible-array member in struct RXBUF. No changes were required
> > within the source code because of the existing padding in RXBUF struct
> 
> You shouldn't rely on padding. Make you change robust independently on
> the padding. See also below.
> 
> > It's worth mentioning that doing a build before/after this patch
> > results in no binary output differences.
> 
> This is interesting...
> 
> > This helps with the ongoing efforts to tighten the FORTIFY_SOURCE
> > routines on memcpy() and help us make progress towards globally
> > enabling -fstrict-flex-arrays=3 [1].
> >
> > Link: https://github.com/KSPP/linux/issues/79
> > Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101836 [1]
> 
> >
> 
> The blank lines are not allowed in the tag block (in case you want to
> have Link: to be recognized as a tag).
> 
> > Signed-off-by: Paulo Miguel Almeida <paulo.miguel.almeida.rodenas@...il.com>
> > ---
> > Changelog:
> >
> > - v2: removed changes to how the size of RXBUF was calculated. I
> >   changed my mind after thinking about the existing padding in the
> >   struct. Happy to discuss it if anyone sees it differently.
> 
> I feel worried about in particular this code:
> 
> /* each buffer has header and data */
> info->rx_buf_size = sizeof(RXBUF) + info->max_frame_size;
> 
> which means that entire rx_alloc_buffers() should be revisited. Also
> take into account the use of one or more macros from overflow.h for
> memory allocation.
> 
> -- 
> With Best Regards,
> Andy Shevchenko

Hi Kees, Hi Andy, Thanks for taking the time to review this patch.

As both of you had similar points, I will reply them here.

The reasons why it had no binary changes was because of the combination
of this 2 things:

1) Existing padding - so sizeof(RXBUF) returned 8 bytes in both cases.

pahole -C RXBUF gcc/before/drivers/char/pcmcia/synclink_cs.ko
typedef struct {
        int                        count;                /*     0     4 */
        unsigned char              status;               /*     4     1 */
        char                       data[1];              /*     5     1 */

        /* size: 8, cachelines: 1, members: 3 */
        /* padding: 2 */
        /* last cacheline: 8 bytes */
} RXBUF;

pahole -C RXBUF gcc/after/drivers/char/pcmcia/synclink_cs.ko
typedef struct {
        int                        count;                /*     0     4 */
        unsigned char              status;               /*     4     1 */
        char                       data[];               /*     5     0 */

        /* size: 8, cachelines: 1, members: 3 */
        /* padding: 3 */
        /* last cacheline: 8 bytes */
} RXBUF;

2) RXBUF (as implemented now) is just  like a pair of lenses from which a
developer can have access to one of the circular buffers in MGSLPC_INFO
struct called 'rx_buf'.

2611 static int rx_alloc_buffers(MGSLPC_INFO *info)
2612 {
2613         /* each buffer has header and data */
2614         info->rx_buf_size = sizeof(RXBUF) + info->max_frame_size;
2615
2616         /* calculate total allocation size for 8 buffers */
2617         info->rx_buf_total_size = info->rx_buf_size * 8;
2618
2619         /* limit total allocated memory */
2620         if (info->rx_buf_total_size > 0x10000)
2621                 info->rx_buf_total_size = 0x10000;
2622
2623         /* calculate number of buffers */
2624         info->rx_buf_count = info->rx_buf_total_size / info->rx_buf_size;
2625
2626         info->rx_buf = kmalloc(info->rx_buf_total_size, GFP_KERNEL);

To be honest, char data[_1_] in RXBUF was never required to be there.
The code base seems to make sure that it doesn't run past its limits by
keeping track of size buffer on MGSLPC_INFO->rx_buf_size (and sometimes
RXBUF->count)

(Addressing one point made by Andy about using of of the macros in
overflow.h)
        struct_size(buf, data, 1) would return 9 bytes which could
        potentially break the existing driver as it produces binary
        changes.

Let me know your thoughts

thanks!

- Paulo A.