* [PATCH] RDMA/core: Use flexible array for mad data
@ 2021-06-16 20:26 Kees Cook
2021-06-22 17:09 ` Jason Gunthorpe
0 siblings, 1 reply; 2+ messages in thread
From: Kees Cook @ 2021-06-16 20:26 UTC (permalink / raw)
To: Doug Ledford
Cc: Kees Cook, Jason Gunthorpe, linux-kernel, linux-rdma, linux-api,
linux-hardening
In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally read across neighboring array fields.
Without a flexible array, this looks like an attempt to perform a
memcpy() read beyond the end of the packet->mad.data array:
drivers/infiniband/core/user_mad.c:
memcpy(packet->msg->mad, packet->mad.data, IB_MGMT_MAD_HDR);
Switch from [0] to [] to use the appropriately handled type for trailing
bytes.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
include/uapi/rdma/ib_user_mad.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/uapi/rdma/ib_user_mad.h b/include/uapi/rdma/ib_user_mad.h
index 90c0cf228020..10b5f6a4c677 100644
--- a/include/uapi/rdma/ib_user_mad.h
+++ b/include/uapi/rdma/ib_user_mad.h
@@ -143,7 +143,7 @@ struct ib_user_mad_hdr {
*/
struct ib_user_mad {
struct ib_user_mad_hdr hdr;
- __aligned_u64 data[0];
+ __aligned_u64 data[];
};
/*
--
2.25.1
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] RDMA/core: Use flexible array for mad data
2021-06-16 20:26 [PATCH] RDMA/core: Use flexible array for mad data Kees Cook
@ 2021-06-22 17:09 ` Jason Gunthorpe
0 siblings, 0 replies; 2+ messages in thread
From: Jason Gunthorpe @ 2021-06-22 17:09 UTC (permalink / raw)
To: Kees Cook
Cc: Doug Ledford, linux-kernel, linux-rdma, linux-api,
linux-hardening
On Wed, Jun 16, 2021 at 01:26:15PM -0700, Kees Cook wrote:
> In preparation for FORTIFY_SOURCE performing compile-time and run-time
> field bounds checking for memcpy(), memmove(), and memset(), avoid
> intentionally read across neighboring array fields.
>
> Without a flexible array, this looks like an attempt to perform a
> memcpy() read beyond the end of the packet->mad.data array:
>
> drivers/infiniband/core/user_mad.c:
> memcpy(packet->msg->mad, packet->mad.data, IB_MGMT_MAD_HDR);
>
> Switch from [0] to [] to use the appropriately handled type for trailing
> bytes.
>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> include/uapi/rdma/ib_user_mad.h | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Applied to for-next, thanks
Jason
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-06-22 17:09 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-06-16 20:26 [PATCH] RDMA/core: Use flexible array for mad data Kees Cook
2021-06-22 17:09 ` Jason Gunthorpe
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).