• Kees Cook's avatar
    octeontx2-af: Avoid field-overflowing memcpy() · ee8e7622
    Kees Cook authored
    In preparation for FORTIFY_SOURCE performing compile-time and run-time
    field bounds checking for memcpy(), memmove(), and memset(), avoid
    intentionally writing across neighboring fields.
    
    To avoid having memcpy() think a u64 "prof" is being written beyond,
    adjust the prof member type by adding struct nix_bandprof_s to the union
    to match the other structs. This silences the following future warning:
    
    In file included from ./include/linux/string.h:253,
                     from ./include/linux/bitmap.h:10,
                     from ./include/linux/cpumask.h:12,
                     from ./arch/x86/include/asm/cpumask.h:5,
                     from ./arch/x86/include/asm/msr.h:11,
                     from ./arch/x86/include/asm/processor.h:22,
                     from ./arch/x86/include/asm/timex.h:5,
                     from ./include/linux/timex.h:65,
                     from ./include/linux/time32.h:13,
                     from ./include/linux/time.h:60,
                     from ./include/linux/stat.h:19,
                     from ./include/linux/module.h:13,
                     from drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c:11:
    In function '__fortify_memcpy_chk',
        inlined from '__fortify_memcpy' at ./include/linux/fortify-string.h:310:2,
        inlined from 'rvu_nix_blk_aq_enq_inst' at drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c:910:5:
    ./include/linux/fortify-string.h:268:4: warning: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); please use struct_group() [-Wattribute-warning]
      268 |    __write_overflow_field();
          |    ^~~~~~~~~~~~~~~~~~~~~~~~
    
    drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c:
    ...
                            else if (req->ctype == NIX_AQ_CTYPE_BANDPROF)
                                    memcpy(&rsp->prof, ctx,
                                           sizeof(struct nix_bandprof_s));
    ...
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    Tested-by: Subbaraya Sundeep<sbhatta@marvell.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    ee8e7622
mbox.h 37.6 KB