Commit b5f0de6d authored by Kees Cook's avatar Kees Cook Committed by Jakub Kicinski

net: dev: Convert sa_data to flexible array in struct sockaddr

One of the worst offenders of "fake flexible arrays" is struct sockaddr,
as it is the classic example of why GCC and Clang have been traditionally
forced to treat all trailing arrays as fake flexible arrays: in the
distant misty past, sa_data became too small, and code started just
treating it as a flexible array, even though it was fixed-size. The
special case by the compiler is specifically that sizeof(sa->sa_data)
and FORTIFY_SOURCE (which uses __builtin_object_size(sa->sa_data, 1))
do not agree (14 and -1 respectively), which makes FORTIFY_SOURCE treat
it as a flexible array.

However, the coming -fstrict-flex-arrays compiler flag will remove
these special cases so that FORTIFY_SOURCE can gain coverage over all
the trailing arrays in the kernel that are _not_ supposed to be treated
as a flexible array. To deal with this change, convert sa_data to a true
flexible array. To keep the structure size the same, move sa_data into
a union with a newly introduced sa_data_min with the original size. The
result is that FORTIFY_SOURCE can continue to have no idea how large
sa_data may actually be, but anything using sizeof(sa->sa_data) must
switch to sizeof(sa->sa_data_min).

Cc: Jens Axboe <axboe@kernel.dk>
Cc: Pavel Begunkov <asml.silence@gmail.com>
Cc: David Ahern <dsahern@kernel.org>
Cc: Dylan Yudaken <dylany@fb.com>
Cc: Yajun Deng <yajun.deng@linux.dev>
Cc: Petr Machata <petrm@nvidia.com>
Cc: Hangbin Liu <liuhangbin@gmail.com>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: syzbot <syzkaller@googlegroups.com>
Cc: Willem de Bruijn <willemb@google.com>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20221018095503.never.671-kees@kernel.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent d6dd5080
...@@ -33,7 +33,10 @@ typedef __kernel_sa_family_t sa_family_t; ...@@ -33,7 +33,10 @@ typedef __kernel_sa_family_t sa_family_t;
struct sockaddr { struct sockaddr {
sa_family_t sa_family; /* address family, AF_xxx */ sa_family_t sa_family; /* address family, AF_xxx */
char sa_data[14]; /* 14 bytes of protocol address */ union {
char sa_data_min[14]; /* Minimum 14 bytes of protocol address */
DECLARE_FLEX_ARRAY(char, sa_data);
};
}; };
struct linger { struct linger {
......
...@@ -8822,7 +8822,7 @@ EXPORT_SYMBOL(dev_set_mac_address_user); ...@@ -8822,7 +8822,7 @@ EXPORT_SYMBOL(dev_set_mac_address_user);
int dev_get_mac_address(struct sockaddr *sa, struct net *net, char *dev_name) int dev_get_mac_address(struct sockaddr *sa, struct net *net, char *dev_name)
{ {
size_t size = sizeof(sa->sa_data); size_t size = sizeof(sa->sa_data_min);
struct net_device *dev; struct net_device *dev;
int ret = 0; int ret = 0;
......
...@@ -342,7 +342,7 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, void __user *data, ...@@ -342,7 +342,7 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, void __user *data,
if (ifr->ifr_hwaddr.sa_family != dev->type) if (ifr->ifr_hwaddr.sa_family != dev->type)
return -EINVAL; return -EINVAL;
memcpy(dev->broadcast, ifr->ifr_hwaddr.sa_data, memcpy(dev->broadcast, ifr->ifr_hwaddr.sa_data,
min(sizeof(ifr->ifr_hwaddr.sa_data), min(sizeof(ifr->ifr_hwaddr.sa_data_min),
(size_t)dev->addr_len)); (size_t)dev->addr_len));
call_netdevice_notifiers(NETDEV_CHANGEADDR, dev); call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
return 0; return 0;
......
...@@ -3277,7 +3277,7 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, ...@@ -3277,7 +3277,7 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr,
int addr_len) int addr_len)
{ {
struct sock *sk = sock->sk; struct sock *sk = sock->sk;
char name[sizeof(uaddr->sa_data) + 1]; char name[sizeof(uaddr->sa_data_min) + 1];
/* /*
* Check legality * Check legality
...@@ -3288,8 +3288,8 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, ...@@ -3288,8 +3288,8 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr,
/* uaddr->sa_data comes from the userspace, it's not guaranteed to be /* uaddr->sa_data comes from the userspace, it's not guaranteed to be
* zero-terminated. * zero-terminated.
*/ */
memcpy(name, uaddr->sa_data, sizeof(uaddr->sa_data)); memcpy(name, uaddr->sa_data, sizeof(uaddr->sa_data_min));
name[sizeof(uaddr->sa_data)] = 0; name[sizeof(uaddr->sa_data_min)] = 0;
return packet_do_bind(sk, name, 0, pkt_sk(sk)->num); return packet_do_bind(sk, name, 0, pkt_sk(sk)->num);
} }
...@@ -3561,11 +3561,11 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr, ...@@ -3561,11 +3561,11 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
return -EOPNOTSUPP; return -EOPNOTSUPP;
uaddr->sa_family = AF_PACKET; uaddr->sa_family = AF_PACKET;
memset(uaddr->sa_data, 0, sizeof(uaddr->sa_data)); memset(uaddr->sa_data, 0, sizeof(uaddr->sa_data_min));
rcu_read_lock(); rcu_read_lock();
dev = dev_get_by_index_rcu(sock_net(sk), READ_ONCE(pkt_sk(sk)->ifindex)); dev = dev_get_by_index_rcu(sock_net(sk), READ_ONCE(pkt_sk(sk)->ifindex));
if (dev) if (dev)
strscpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data)); strscpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data_min));
rcu_read_unlock(); rcu_read_unlock();
return sizeof(*uaddr); return sizeof(*uaddr);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment