[PATCH v1 net] af_packet: Fix fortified memcpy() without flex array.

[PATCH v1 net] af_packet: Fix fortified memcpy() without flex array.

[Kuniyuki Iwashima]

Sergei Trofimovich reported a regression [0] caused by commit a0ade8404c3b
("af_packet: Fix warning of fortified memcpy() in packet_getname().").

It introduced a flex array sll_addr_flex in struct sockaddr_ll as a
union-ed member with sll_addr to work around the fortified memcpy() check.

However, a userspace program uses a struct that has struct sockaddr_ll in
the middle, where a flex array is illegal to exist.

  include/linux/if_packet.h:24:17: error: flexible array member 'sockaddr_ll::<unnamed union>::<unnamed struct>::sll_addr_flex' not at end of 'struct packet_info_t'
     24 |                 __DECLARE_FLEX_ARRAY(unsigned char, sll_addr_flex);
        |                 ^~~~~~~~~~~~~~~~~~~~

To fix the regression, let's go back to the first attempt [1] telling
memcpy() the actual size of the array.

Reported-by: Sergei Trofimovich <slyich@gmail.com>
Closes: https://github.com/NixOS/nixpkgs/pull/252587#issuecomment-1741733002 [0]
Link: https://lore.kernel.org/netdev/20230720004410.87588-3-kuniyu@amazon.com/ [1]
Fixes: a0ade8404c3b ("af_packet: Fix warning of fortified memcpy() in packet_getname().")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
---
 include/uapi/linux/if_packet.h | 6 +-----
 net/packet/af_packet.c         | 7 ++++++-
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/include/uapi/linux/if_packet.h b/include/uapi/linux/if_packet.h
index 4d0ad22f83b5..9efc42382fdb 100644
--- a/include/uapi/linux/if_packet.h
+++ b/include/uapi/linux/if_packet.h
@@ -18,11 +18,7 @@ struct sockaddr_ll {
 	unsigned short	sll_hatype;
 	unsigned char	sll_pkttype;
 	unsigned char	sll_halen;
-	union {
-		unsigned char	sll_addr[8];
-		/* Actual length is in sll_halen. */
-		__DECLARE_FLEX_ARRAY(unsigned char, sll_addr_flex);
-	};
+	unsigned char	sll_addr[8];
 };
 
 /* Packet types */
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 8f97648d652f..a84e00b5904b 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3607,7 +3607,12 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
 	if (dev) {
 		sll->sll_hatype = dev->type;
 		sll->sll_halen = dev->addr_len;
-		memcpy(sll->sll_addr_flex, dev->dev_addr, dev->addr_len);
+
+		/* Let __fortify_memcpy_chk() know the actual buffer size. */
+		memcpy(((struct sockaddr_storage *)sll)->__data +
+		       offsetof(struct sockaddr_ll, sll_addr) -
+		       offsetofend(struct sockaddr_ll, sll_family),
+		       dev->dev_addr, dev->addr_len);
 	} else {
 		sll->sll_hatype = 0;	/* Bad: we have no ARPHRD_UNSPEC */
 		sll->sll_halen = 0;
-- 
2.30.2

Re: [PATCH v1 net] af_packet: Fix fortified memcpy() without flex array.

[Kees Cook]

On Mon, Oct 09, 2023 at 08:31:52AM -0700, Kuniyuki Iwashima wrote:
> Sergei Trofimovich reported a regression [0] caused by commit a0ade8404c3b
> ("af_packet: Fix warning of fortified memcpy() in packet_getname().").
> 
> It introduced a flex array sll_addr_flex in struct sockaddr_ll as a
> union-ed member with sll_addr to work around the fortified memcpy() check.
> 
> However, a userspace program uses a struct that has struct sockaddr_ll in
> the middle, where a flex array is illegal to exist.
> 
>   include/linux/if_packet.h:24:17: error: flexible array member 'sockaddr_ll::<unnamed union>::<unnamed struct>::sll_addr_flex' not at end of 'struct packet_info_t'
>      24 |                 __DECLARE_FLEX_ARRAY(unsigned char, sll_addr_flex);
>         |                 ^~~~~~~~~~~~~~~~~~~~
> To fix the regression, let's go back to the first attempt [1] telling
> memcpy() the actual size of the array.
> 
> Reported-by: Sergei Trofimovich <slyich@gmail.com>
> Closes: https://github.com/NixOS/nixpkgs/pull/252587#issuecomment-1741733002 [0]

Eww. That's a buggy definition -- it could get overflowed.

But okay, we don't break userspace.

> Link: https://lore.kernel.org/netdev/20230720004410.87588-3-kuniyu@amazon.com/ [1]
> Fixes: a0ade8404c3b ("af_packet: Fix warning of fortified memcpy() in packet_getname().")
> Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
> ---
>  include/uapi/linux/if_packet.h | 6 +-----
>  net/packet/af_packet.c         | 7 ++++++-
>  2 files changed, 7 insertions(+), 6 deletions(-)
> 
> diff --git a/include/uapi/linux/if_packet.h b/include/uapi/linux/if_packet.h
> index 4d0ad22f83b5..9efc42382fdb 100644
> --- a/include/uapi/linux/if_packet.h
> +++ b/include/uapi/linux/if_packet.h
> @@ -18,11 +18,7 @@ struct sockaddr_ll {
>  	unsigned short	sll_hatype;
>  	unsigned char	sll_pkttype;
>  	unsigned char	sll_halen;
> -	union {
> -		unsigned char	sll_addr[8];
> -		/* Actual length is in sll_halen. */
> -		__DECLARE_FLEX_ARRAY(unsigned char, sll_addr_flex);
> -	};
> +	unsigned char	sll_addr[8];
>  };

Yup, we need to do at least this.

>  
>  /* Packet types */
> diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
> index 8f97648d652f..a84e00b5904b 100644
> --- a/net/packet/af_packet.c
> +++ b/net/packet/af_packet.c
> @@ -3607,7 +3607,12 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
>  	if (dev) {
>  		sll->sll_hatype = dev->type;
>  		sll->sll_halen = dev->addr_len;
> -		memcpy(sll->sll_addr_flex, dev->dev_addr, dev->addr_len);
> +
> +		/* Let __fortify_memcpy_chk() know the actual buffer size. */
> +		memcpy(((struct sockaddr_storage *)sll)->__data +
> +		       offsetof(struct sockaddr_ll, sll_addr) -
> +		       offsetofend(struct sockaddr_ll, sll_family),
> +		       dev->dev_addr, dev->addr_len);
>  	} else {
>  		sll->sll_hatype = 0;	/* Bad: we have no ARPHRD_UNSPEC */
>  		sll->sll_halen = 0;

I still think this is a mistake. We're papering over so many lies to the
compiler. :P If "uaddr" is actually "struct sockaddr_storage", then we
should update the callers... and if "struct sockaddr_ll" doesn't have a
fixed size trailing array, we should make a new struct that is telling
the truth. ;)

Perhaps add this to the UAPI:

+struct sockaddr_ll_flex {
+       unsigned short  sll_family;
+       __be16          sll_protocol;
+       int             sll_ifindex;
+       unsigned short  sll_hatype;
+       unsigned char   sll_pkttype;
+       unsigned char   sll_halen;
+       unsigned char   sll_addr[] __counted_by(sll_halen);
+};

And update the memcpy():

-       DECLARE_SOCKADDR(struct sockaddr_ll *, sll, uaddr);
+       struct sockaddr_ll_flex * sll = (struct sockaddr_ll_flex *)uaddr;

?

-- 
Kees Cook

Re: [PATCH v1 net] af_packet: Fix fortified memcpy() without flex array.

[Kuniyuki Iwashima]

From: Kees Cook <keescook@chromium.org>
Date: Mon, 9 Oct 2023 09:01:34 -0700
> On Mon, Oct 09, 2023 at 08:31:52AM -0700, Kuniyuki Iwashima wrote:
> > Sergei Trofimovich reported a regression [0] caused by commit a0ade8404c3b
> > ("af_packet: Fix warning of fortified memcpy() in packet_getname().").
> > 
> > It introduced a flex array sll_addr_flex in struct sockaddr_ll as a
> > union-ed member with sll_addr to work around the fortified memcpy() check.
> > 
> > However, a userspace program uses a struct that has struct sockaddr_ll in
> > the middle, where a flex array is illegal to exist.
> > 
> >   include/linux/if_packet.h:24:17: error: flexible array member 'sockaddr_ll::<unnamed union>::<unnamed struct>::sll_addr_flex' not at end of 'struct packet_info_t'
> >      24 |                 __DECLARE_FLEX_ARRAY(unsigned char, sll_addr_flex);
> >         |                 ^~~~~~~~~~~~~~~~~~~~
> > To fix the regression, let's go back to the first attempt [1] telling
> > memcpy() the actual size of the array.
> > 
> > Reported-by: Sergei Trofimovich <slyich@gmail.com>
> > Closes: https://github.com/NixOS/nixpkgs/pull/252587#issuecomment-1741733002 [0]
> 
> Eww. That's a buggy definition -- it could get overflowed.

Only if they pass sizeof(struct sockaddr_storage) to getsockname().


> 
> But okay, we don't break userspace.
> 
> > Link: https://lore.kernel.org/netdev/20230720004410.87588-3-kuniyu@amazon.com/ [1]
> > Fixes: a0ade8404c3b ("af_packet: Fix warning of fortified memcpy() in packet_getname().")
> > Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
> > ---
> >  include/uapi/linux/if_packet.h | 6 +-----
> >  net/packet/af_packet.c         | 7 ++++++-
> >  2 files changed, 7 insertions(+), 6 deletions(-)
> > 
> > diff --git a/include/uapi/linux/if_packet.h b/include/uapi/linux/if_packet.h
> > index 4d0ad22f83b5..9efc42382fdb 100644
> > --- a/include/uapi/linux/if_packet.h
> > +++ b/include/uapi/linux/if_packet.h
> > @@ -18,11 +18,7 @@ struct sockaddr_ll {
> >  	unsigned short	sll_hatype;
> >  	unsigned char	sll_pkttype;
> >  	unsigned char	sll_halen;
> > -	union {
> > -		unsigned char	sll_addr[8];
> > -		/* Actual length is in sll_halen. */
> > -		__DECLARE_FLEX_ARRAY(unsigned char, sll_addr_flex);
> > -	};
> > +	unsigned char	sll_addr[8];
> >  };
> 
> Yup, we need to do at least this.
> 
> >  
> >  /* Packet types */
> > diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
> > index 8f97648d652f..a84e00b5904b 100644
> > --- a/net/packet/af_packet.c
> > +++ b/net/packet/af_packet.c
> > @@ -3607,7 +3607,12 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
> >  	if (dev) {
> >  		sll->sll_hatype = dev->type;
> >  		sll->sll_halen = dev->addr_len;
> > -		memcpy(sll->sll_addr_flex, dev->dev_addr, dev->addr_len);
> > +
> > +		/* Let __fortify_memcpy_chk() know the actual buffer size. */
> > +		memcpy(((struct sockaddr_storage *)sll)->__data +
> > +		       offsetof(struct sockaddr_ll, sll_addr) -
> > +		       offsetofend(struct sockaddr_ll, sll_family),
> > +		       dev->dev_addr, dev->addr_len);
> >  	} else {
> >  		sll->sll_hatype = 0;	/* Bad: we have no ARPHRD_UNSPEC */
> >  		sll->sll_halen = 0;
> 
> I still think this is a mistake. We're papering over so many lies to the
> compiler. :P If "uaddr" is actually "struct sockaddr_storage", then we
> should update the callers...

We could update all callers to pass sockaddr_storage but it seems too much
for net.git.. :/  I think the conversion should be done later for net-next.

  $ grep -rn -E "\.getname.*?=" | cut -f 2 -d"=" | sort | uniq | wc -l
  40


> and if "struct sockaddr_ll" doesn't have a
> fixed size trailing array, we should make a new struct that is telling
> the truth. ;)
> 
> Perhaps add this to the UAPI:
> 
> +struct sockaddr_ll_flex {
> +       unsigned short  sll_family;
> +       __be16          sll_protocol;
> +       int             sll_ifindex;
> +       unsigned short  sll_hatype;
> +       unsigned char   sll_pkttype;
> +       unsigned char   sll_halen;
> +       unsigned char   sll_addr[] __counted_by(sll_halen);
> +};
> 
> And update the memcpy():
> 
> -       DECLARE_SOCKADDR(struct sockaddr_ll *, sll, uaddr);
> +       struct sockaddr_ll_flex * sll = (struct sockaddr_ll_flex *)uaddr;
> 
> ?
> 
> -- 
> Kees Cook

Re: [PATCH v1 net] af_packet: Fix fortified memcpy() without flex array.

[Kees Cook]

On Mon, Oct 09, 2023 at 10:12:28AM -0700, Kuniyuki Iwashima wrote:
> From: Kees Cook <keescook@chromium.org>
> Date: Mon, 9 Oct 2023 09:01:34 -0700
> > On Mon, Oct 09, 2023 at 08:31:52AM -0700, Kuniyuki Iwashima wrote:
> > > Sergei Trofimovich reported a regression [0] caused by commit a0ade8404c3b
> > > ("af_packet: Fix warning of fortified memcpy() in packet_getname().").
> > > 
> > > It introduced a flex array sll_addr_flex in struct sockaddr_ll as a
> > > union-ed member with sll_addr to work around the fortified memcpy() check.
> > > 
> > > However, a userspace program uses a struct that has struct sockaddr_ll in
> > > the middle, where a flex array is illegal to exist.
> > > 
> > >   include/linux/if_packet.h:24:17: error: flexible array member 'sockaddr_ll::<unnamed union>::<unnamed struct>::sll_addr_flex' not at end of 'struct packet_info_t'
> > >      24 |                 __DECLARE_FLEX_ARRAY(unsigned char, sll_addr_flex);
> > >         |                 ^~~~~~~~~~~~~~~~~~~~
> > > To fix the regression, let's go back to the first attempt [1] telling
> > > memcpy() the actual size of the array.
> > > 
> > > Reported-by: Sergei Trofimovich <slyich@gmail.com>
> > > Closes: https://github.com/NixOS/nixpkgs/pull/252587#issuecomment-1741733002 [0]
> > 
> > Eww. That's a buggy definition -- it could get overflowed.
> 
> Only if they pass sizeof(struct sockaddr_storage) to getsockname().
> 
> 
> > 
> > But okay, we don't break userspace.
> > 
> > > Link: https://lore.kernel.org/netdev/20230720004410.87588-3-kuniyu@amazon.com/ [1]
> > > Fixes: a0ade8404c3b ("af_packet: Fix warning of fortified memcpy() in packet_getname().")
> > > Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
> > > ---
> > >  include/uapi/linux/if_packet.h | 6 +-----
> > >  net/packet/af_packet.c         | 7 ++++++-
> > >  2 files changed, 7 insertions(+), 6 deletions(-)
> > > 
> > > diff --git a/include/uapi/linux/if_packet.h b/include/uapi/linux/if_packet.h
> > > index 4d0ad22f83b5..9efc42382fdb 100644
> > > --- a/include/uapi/linux/if_packet.h
> > > +++ b/include/uapi/linux/if_packet.h
> > > @@ -18,11 +18,7 @@ struct sockaddr_ll {
> > >  	unsigned short	sll_hatype;
> > >  	unsigned char	sll_pkttype;
> > >  	unsigned char	sll_halen;
> > > -	union {
> > > -		unsigned char	sll_addr[8];
> > > -		/* Actual length is in sll_halen. */
> > > -		__DECLARE_FLEX_ARRAY(unsigned char, sll_addr_flex);
> > > -	};
> > > +	unsigned char	sll_addr[8];
> > >  };
> > 
> > Yup, we need to do at least this.
> > 
> > >  
> > >  /* Packet types */
> > > diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
> > > index 8f97648d652f..a84e00b5904b 100644
> > > --- a/net/packet/af_packet.c
> > > +++ b/net/packet/af_packet.c
> > > @@ -3607,7 +3607,12 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
> > >  	if (dev) {
> > >  		sll->sll_hatype = dev->type;
> > >  		sll->sll_halen = dev->addr_len;
> > > -		memcpy(sll->sll_addr_flex, dev->dev_addr, dev->addr_len);
> > > +
> > > +		/* Let __fortify_memcpy_chk() know the actual buffer size. */
> > > +		memcpy(((struct sockaddr_storage *)sll)->__data +
> > > +		       offsetof(struct sockaddr_ll, sll_addr) -
> > > +		       offsetofend(struct sockaddr_ll, sll_family),
> > > +		       dev->dev_addr, dev->addr_len);
> > >  	} else {
> > >  		sll->sll_hatype = 0;	/* Bad: we have no ARPHRD_UNSPEC */
> > >  		sll->sll_halen = 0;
> > 
> > I still think this is a mistake. We're papering over so many lies to the
> > compiler. :P If "uaddr" is actually "struct sockaddr_storage", then we
> > should update the callers...
> 
> We could update all callers to pass sockaddr_storage but it seems too much
> for net.git.. :/  I think the conversion should be done later for net-next.
> 
>   $ grep -rn -E "\.getname.*?=" | cut -f 2 -d"=" | sort | uniq | wc -l
>   40

Agreed -- it's something to do going forward. Your fix is likely the
right approach to take to undo the UAPI change.

-Kees

-- 
Kees Cook

Re: [PATCH v1 net] af_packet: Fix fortified memcpy() without flex array.

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Mon, 9 Oct 2023 08:31:52 -0700 you wrote:
> Sergei Trofimovich reported a regression [0] caused by commit a0ade8404c3b
> ("af_packet: Fix warning of fortified memcpy() in packet_getname().").
> 
> It introduced a flex array sll_addr_flex in struct sockaddr_ll as a
> union-ed member with sll_addr to work around the fortified memcpy() check.
> 
> However, a userspace program uses a struct that has struct sockaddr_ll in
> the middle, where a flex array is illegal to exist.
> 
> [...]

Here is the summary with links:
  - [v1,net] af_packet: Fix fortified memcpy() without flex array.
    https://git.kernel.org/netdev/net/c/e2bca4870fda

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html