netdev - Re: [PATCH nf-next v2 1/4] ipvs: Update width of source for ip_vs_sync_conn

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20230411113924.6vhibpekifbyjksg@soft-dev3-1>
Date:   Tue, 11 Apr 2023 13:39:24 +0200
From:   Horatiu Vultur <horatiu.vultur@...rochip.com>
To:     Simon Horman <horms@...nel.org>
CC:     Julian Anastasov <ja@....bg>,
        Pablo Neira Ayuso <pablo@...filter.org>,
        Jozsef Kadlecsik <kadlec@...filter.org>,
        Florian Westphal <fw@...len.de>, <netdev@...r.kernel.org>,
        "David S. Miller" <davem@...emloft.net>,
        David Ahern <dsahern@...nel.org>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>, <lvs-devel@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>, <netfilter-devel@...r.kernel.org>,
        <coreteam@...filter.org>
Subject: Re: [PATCH nf-next v2 1/4] ipvs: Update width of source for
 ip_vs_sync_conn_options

The 04/11/2023 09:10, Simon Horman wrote:
> 
> In ip_vs_sync_conn_v0() copy is made to struct ip_vs_sync_conn_options.
> That structure looks like this:
> 
> struct ip_vs_sync_conn_options {
>         struct ip_vs_seq        in_seq;
>         struct ip_vs_seq        out_seq;
> };
> 
> The source of the copy is the in_seq field of struct ip_vs_conn.  Whose
> type is struct ip_vs_seq. Thus we can see that the source - is not as
> wide as the amount of data copied, which is the width of struct
> ip_vs_sync_conn_option.
> 
> The copy is safe because the next field in is another struct ip_vs_seq.
> Make use of struct_group() to annotate this.
> 
> Flagged by gcc-13 as:
> 
>  In file included from ./include/linux/string.h:254,
>                   from ./include/linux/bitmap.h:11,
>                   from ./include/linux/cpumask.h:12,
>                   from ./arch/x86/include/asm/paravirt.h:17,
>                   from ./arch/x86/include/asm/cpuid.h:62,
>                   from ./arch/x86/include/asm/processor.h:19,
>                   from ./arch/x86/include/asm/timex.h:5,
>                   from ./include/linux/timex.h:67,
>                   from ./include/linux/time32.h:13,
>                   from ./include/linux/time.h:60,
>                   from ./include/linux/stat.h:19,
>                   from ./include/linux/module.h:13,
>                   from net/netfilter/ipvs/ip_vs_sync.c:38:
>  In function 'fortify_memcpy_chk',
>      inlined from 'ip_vs_sync_conn_v0' at net/netfilter/ipvs/ip_vs_sync.c:606:3:
>  ./include/linux/fortify-string.h:529:25: error: call to '__read_overflow2_field' declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror=attribute-warning]
>    529 |                         __read_overflow2_field(q_size_field, size);
>        |
> 
> Compile tested only.

Reviewed-by: Horatiu Vultur <horatiu.vultur@...rochip.com>

> 
> Signed-off-by: Simon Horman <horms@...nel.org>
> ---
> v2
> * Correct spelling of 'conn' in subject
> ---
>  include/net/ip_vs.h             | 6 ++++--
>  net/netfilter/ipvs/ip_vs_sync.c | 2 +-
>  2 files changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
> index 6d71a5ff52df..e20f1f92066d 100644
> --- a/include/net/ip_vs.h
> +++ b/include/net/ip_vs.h
> @@ -630,8 +630,10 @@ struct ip_vs_conn {
>          */
>         struct ip_vs_app        *app;           /* bound ip_vs_app object */
>         void                    *app_data;      /* Application private data */
> -       struct ip_vs_seq        in_seq;         /* incoming seq. struct */
> -       struct ip_vs_seq        out_seq;        /* outgoing seq. struct */
> +       struct_group(sync_conn_opt,
> +               struct ip_vs_seq  in_seq;       /* incoming seq. struct */
> +               struct ip_vs_seq  out_seq;      /* outgoing seq. struct */
> +       );
> 
>         const struct ip_vs_pe   *pe;
>         char                    *pe_data;
> diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
> index 4963fec815da..d4fe7bb4f853 100644
> --- a/net/netfilter/ipvs/ip_vs_sync.c
> +++ b/net/netfilter/ipvs/ip_vs_sync.c
> @@ -603,7 +603,7 @@ static void ip_vs_sync_conn_v0(struct netns_ipvs *ipvs, struct ip_vs_conn *cp,
>         if (cp->flags & IP_VS_CONN_F_SEQ_MASK) {
>                 struct ip_vs_sync_conn_options *opt =
>                         (struct ip_vs_sync_conn_options *)&s[1];
> -               memcpy(opt, &cp->in_seq, sizeof(*opt));
> +               memcpy(opt, &cp->sync_conn_opt, sizeof(*opt));
>         }
> 
>         m->nr_conns++;
> 
> --
> 2.30.2
> 

-- 
/Horatiu