linux/net/core
Gustavo A. R. Silva 91b4d44c7c flow_dissector: Fix out-of-bounds warnings
[ Upstream commit 323e0cb473e2a8706ff162b6b4f4fa16023c9ba7 ]

Fix the following out-of-bounds warnings:

    net/core/flow_dissector.c: In function '__skb_flow_dissect':
>> net/core/flow_dissector.c:1104:4: warning: 'memcpy' offset [24, 39] from the object at '<unknown>' is out of the bounds of referenced subobject 'saddr' with type 'struct in6_addr' at offset 8 [-Warray-bounds]
     1104 |    memcpy(&key_addrs->v6addrs, &iph->saddr,
          |    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     1105 |           sizeof(key_addrs->v6addrs));
          |           ~~~~~~~~~~~~~~~~~~~~~~~~~~~
    In file included from include/linux/ipv6.h:5,
                     from net/core/flow_dissector.c:6:
    include/uapi/linux/ipv6.h:133:18: note: subobject 'saddr' declared here
      133 |  struct in6_addr saddr;
          |                  ^~~~~
>> net/core/flow_dissector.c:1059:4: warning: 'memcpy' offset [16, 19] from the object at '<unknown>' is out of the bounds of referenced subobject 'saddr' with type 'unsigned int' at offset 12 [-Warray-bounds]
     1059 |    memcpy(&key_addrs->v4addrs, &iph->saddr,
          |    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     1060 |           sizeof(key_addrs->v4addrs));
          |           ~~~~~~~~~~~~~~~~~~~~~~~~~~~
    In file included from include/linux/ip.h:17,
                     from net/core/flow_dissector.c:5:
    include/uapi/linux/ip.h:103:9: note: subobject 'saddr' declared here
      103 |  __be32 saddr;
          |         ^~~~~

The problem is that the original code is trying to copy data into a
couple of struct members adjacent to each other in a single call to
memcpy().  So, the compiler legitimately complains about it. As these
are just a couple of members, fix this by copying each one of them in
separate calls to memcpy().

This helps with the ongoing efforts to globally enable -Warray-bounds
and get us closer to being able to tighten the FORTIFY_SOURCE routines
on memcpy().

Link: https://github.com/KSPP/linux/issues/109
Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/lkml/d5ae2e65-1f18-2577-246f-bada7eee6ccd@intel.com/
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-22 12:26:29 +02:00
..
Makefile
bpf_sk_storage.c bpf: Improve bucket_log calculation logic 2020-02-14 16:34:10 -05:00
datagram.c udp: fix skb_copy_and_csum_datagram with odd segment sizes 2021-02-17 10:35:19 +01:00
datagram.h
dev.c net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT 2021-07-19 08:53:08 +02:00
dev_addr_lists.c
dev_ioctl.c net: fix dev_ifsioc_locked() race condition 2021-03-07 12:20:43 +01:00
devlink.c devlink: Hold rtnl lock while reading netdev attributes 2020-12-08 10:40:23 +01:00
drop_monitor.c drop_monitor: work around gcc-10 stringop-overflow warning 2020-05-20 08:20:06 +02:00
dst.c
dst_cache.c
ethtool.c net: ethtool: clear heap allocations for ethtool function 2021-06-30 08:47:47 -04:00
failover.c
fib_notifier.c
fib_rules.c fib: Return the correct errno code 2021-06-18 09:59:00 +02:00
filter.c bpf: Do not change gso_size during bpf_skb_change_proto() 2021-07-14 16:53:32 +02:00
flow_dissector.c flow_dissector: Fix out-of-bounds warnings 2021-09-22 12:26:29 +02:00
flow_offload.c net: core: rename indirect block ingress cb function 2019-12-18 16:08:47 +01:00
gen_estimator.c net_sched: gen_estimator: support large ewma log 2021-02-07 15:35:47 +01:00
gen_stats.c
gro_cells.c
hwbm.c
link_watch.c net: linkwatch: fix failure to restore device state across suspend/resume 2021-08-18 08:57:00 +02:00
lwt_bpf.c lwt: Disable BH too in run_lwt_bpf() 2020-12-30 11:51:30 +01:00
lwtunnel.c
neighbour.c neighbour: allow NUD_NOARP entries to be forced GCed 2021-06-10 13:37:16 +02:00
net-procfs.c
net-sysfs.c net-sysfs: take the rtnl lock when accessing xps_rxqs_map and num_tc 2021-01-12 20:16:13 +01:00
net-sysfs.h
net-traces.c
net_namespace.c netns: protect netns ID lookups with RCU 2021-09-15 09:47:31 +02:00
netclassid_cgroup.c cgroup, netclassid: remove double cond_resched 2020-05-10 10:31:32 +02:00
netevent.c
netpoll.c net: Have netpoll bring-up DSA management interface 2020-11-24 13:28:57 +01:00
netprio_cgroup.c netprio_cgroup: Fix unlimited memory leak of v2 cgroups 2020-05-20 08:20:12 +02:00
page_pool.c mm: fix struct page layout on 32-bit systems 2021-05-19 10:08:31 +02:00
pktgen.c pktgen: fix misuse of BUG_ON() in pktgen_thread_worker() 2021-03-07 12:20:44 +01:00
ptp_classifier.c
request_sock.c
rtnetlink.c rtnetlink: Return correct error on changing device netns 2021-09-03 10:08:14 +02:00
scm.c
secure_seq.c
skbuff.c net: Fix zero-copy head len calculation. 2021-08-08 09:04:08 +02:00
skmsg.c bpf, sockmap: Avoid returning unneeded EAGAIN when redirecting to self 2020-11-24 13:29:19 +01:00
sock.c net: annotate data race around sk_ll_usec 2021-07-31 08:19:38 +02:00
sock_diag.c
sock_map.c bpf: sockmap: Require attach_bpf_fd when detaching a program 2020-08-07 09:34:02 +02:00
sock_reuseport.c udp: Prevent reuseport_select_sock from reading uninitialized socks 2021-01-23 15:57:56 +01:00
stream.c
sysctl_net_core.c bpf: Check correct cred for CAP_SYSLOG in bpf_dump_raw_ok() 2020-07-16 08:16:45 +02:00
timestamping.c
tso.c
utils.c net: Fix skb->csum update in inet_proto_csum_replace16(). 2020-02-05 21:22:52 +00:00
xdp.c xdp: obtain the mem_id mutex before trying to remove an entry. 2019-12-18 16:09:10 +01:00