[PATCH] fortify: Use __struct_size replace __member_size

[PATCH] fortify: Use __struct_size replace __member_size

[15074444048]

From: lihaojie <lihaojie@kylinos.cn>

Use __struct_size get destination size.

Size of destination less of the size to be written will
make buffer overflow, the size of destination should be
complete.

Signed-off-by: lihaojie <lihaojie@kylinos.cn>
---
 include/linux/fortify-string.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/fortify-string.h b/include/linux/fortify-string.h
index 0d99bf11d260..0504b2c8aab7 100644
--- a/include/linux/fortify-string.h
+++ b/include/linux/fortify-string.h
@@ -277,7 +277,7 @@ extern ssize_t __real_strscpy(char *, const char *, size_t) __RENAME(sized_strsc
 __FORTIFY_INLINE ssize_t sized_strscpy(char * const POS p, const char * const POS q, size_t size)
 {
 	/* Use string size rather than possible enclosing struct size. */
-	const size_t p_size = __member_size(p);
+	const size_t p_size = __struct_size(p);
 	const size_t q_size = __member_size(q);
 	size_t len;
 
-- 
2.25.1

Re: [PATCH] fortify: Use __struct_size replace __member_size

[Kees Cook]

On December 4, 2024 4:41:49 PM GMT+10:00, 15074444048@163.com wrote:
>From: lihaojie <lihaojie@kylinos.cn>
>
>Use __struct_size get destination size.
>
>Size of destination less of the size to be written will
>make buffer overflow, the size of destination should be
>complete.
>

I cannot understand what you mean here. Have you encountered a problem where a destination size is incorrectly calculated?

>Signed-off-by: lihaojie <lihaojie@kylinos.cn>
>---
> include/linux/fortify-string.h | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/include/linux/fortify-string.h b/include/linux/fortify-string.h
>index 0d99bf11d260..0504b2c8aab7 100644
>--- a/include/linux/fortify-string.h
>+++ b/include/linux/fortify-string.h
>@@ -277,7 +277,7 @@ extern ssize_t __real_strscpy(char *, const char *, size_t) __RENAME(sized_strsc
> __FORTIFY_INLINE ssize_t sized_strscpy(char * const POS p, const char * const POS q, size_t size)
> {
> 	/* Use string size rather than possible enclosing struct size. */
>-	const size_t p_size = __member_size(p);
>+	const size_t p_size = __struct_size(p);

No, this must not be done. (See the comment immediately above it.) We must limit the maximum write size to the length of the target buffe, not the enclosing structure that contains it.

-Kees

-- 
Kees Cook