From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Kees Cook <keescook@chromium.org>,
"David S . Miller" <davem@davemloft.net>,
Sasha Levin <sashal@kernel.org>,
benve@cisco.com, satishkh@cisco.com, edumazet@google.com,
kuba@kernel.org, pabeni@redhat.com, netdev@vger.kernel.org,
linux-hardening@vger.kernel.org
Subject: [PATCH AUTOSEL 6.1 10/12] enic: Avoid false positive under FORTIFY_SOURCE
Date: Thu, 29 Feb 2024 15:40:32 -0500 [thread overview]
Message-ID: <20240229204039.2861519-10-sashal@kernel.org> (raw)
In-Reply-To: <20240229204039.2861519-1-sashal@kernel.org>
From: Kees Cook <keescook@chromium.org>
[ Upstream commit 40b9385dd8e6a0515e1c9cd06a277483556b7286 ]
FORTIFY_SOURCE has been ignoring 0-sized destinations while the kernel
code base has been converted to flexible arrays. In order to enforce
the 0-sized destinations (e.g. with __counted_by), the remaining 0-sized
destinations need to be handled. Unfortunately, struct vic_provinfo
resists full conversion, as it contains a flexible array of flexible
arrays, which is only possible with the 0-sized fake flexible array.
Use unsafe_memcpy() to avoid future false positives under
CONFIG_FORTIFY_SOURCE.
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/cisco/enic/vnic_vic.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/cisco/enic/vnic_vic.c b/drivers/net/ethernet/cisco/enic/vnic_vic.c
index 20fcb20b42ede..66b5778353389 100644
--- a/drivers/net/ethernet/cisco/enic/vnic_vic.c
+++ b/drivers/net/ethernet/cisco/enic/vnic_vic.c
@@ -49,7 +49,8 @@ int vic_provinfo_add_tlv(struct vic_provinfo *vp, u16 type, u16 length,
tlv->type = htons(type);
tlv->length = htons(length);
- memcpy(tlv->value, value, length);
+ unsafe_memcpy(tlv->value, value, length,
+ /* Flexible array of flexible arrays */);
vp->num_tlvs = htonl(ntohl(vp->num_tlvs) + 1);
vp->length = htonl(ntohl(vp->length) +
--
2.43.0
next prev parent reply other threads:[~2024-02-29 20:40 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-02-29 20:40 [PATCH AUTOSEL 6.1 01/12] soc: microchip: Fix POLARFIRE_SOC_SYS_CTRL input prompt Sasha Levin
2024-02-29 20:40 ` [PATCH AUTOSEL 6.1 02/12] RDMA/mlx5: Fix fortify source warning while accessing Eth segment Sasha Levin
2024-02-29 20:40 ` [PATCH AUTOSEL 6.1 03/12] RDMA/mlx5: Relax DEVX access upon modify commands Sasha Levin
2024-02-29 20:40 ` [PATCH AUTOSEL 6.1 04/12] riscv: dts: sifive: add missing #interrupt-cells to pmic Sasha Levin
2024-02-29 20:40 ` Sasha Levin
2024-02-29 20:40 ` [PATCH AUTOSEL 6.1 05/12] x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h Sasha Levin
2024-02-29 20:40 ` [PATCH AUTOSEL 6.1 06/12] x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() Sasha Levin
2024-02-29 20:40 ` [PATCH AUTOSEL 6.1 07/12] net/iucv: fix the allocation size of iucv_path_table array Sasha Levin
2024-02-29 20:40 ` [PATCH AUTOSEL 6.1 08/12] parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check Sasha Levin
2024-02-29 20:40 ` [PATCH AUTOSEL 6.1 09/12] block: sed-opal: handle empty atoms when parsing response Sasha Levin
2024-02-29 20:40 ` Sasha Levin [this message]
2024-03-11 21:03 ` [PATCH AUTOSEL 6.1 10/12] enic: Avoid false positive under FORTIFY_SOURCE Pavel Machek
2024-03-18 12:50 ` Sasha Levin
2024-02-29 20:40 ` [PATCH AUTOSEL 6.1 11/12] dm-verity, dm-crypt: align "struct bvec_iter" correctly Sasha Levin
2024-02-29 20:40 ` [PATCH AUTOSEL 6.1 12/12] arm64: dts: Fix dtc interrupt_provider warnings Sasha Levin
2024-02-29 20:40 ` Sasha Levin
2024-03-11 21:04 ` Pavel Machek
2024-03-11 21:04 ` Pavel Machek
2024-03-12 8:20 ` Geert Uytterhoeven
2024-03-12 8:20 ` Geert Uytterhoeven
2024-03-12 8:38 ` Pavel Machek
2024-03-12 8:38 ` Pavel Machek
2024-03-12 8:43 ` Geert Uytterhoeven
2024-03-12 8:43 ` Geert Uytterhoeven
2024-03-12 9:12 ` AngeloGioacchino Del Regno
2024-03-12 9:12 ` AngeloGioacchino Del Regno
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240229204039.2861519-10-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=benve@cisco.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=keescook@chromium.org \
--cc=kuba@kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=satishkh@cisco.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.