Commit 2b7a8dc0 authored by Kees Cook's avatar Kees Cook Committed by Jens Axboe

s390/dasd: Avoid field over-reading memcpy()

In preparation for FORTIFY_SOURCE performing compile-time and run-time
field array bounds checking for memcpy(), memmove(), and memset(),
avoid intentionally reading across neighboring array fields.

Add a wrapping structure to serve as the memcpy() source, so the compiler
can do appropriate bounds checking, avoiding this future warning:

In function '__fortify_memcpy',
    inlined from 'create_uid' at drivers/s390/block/dasd_eckd.c:749:2:
./include/linux/fortify-string.h:246:4: error: call to '__read_overflow2_field' declared with attribute error: detected read beyond size of field (2nd parameter)
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarStefan Haberland <sth@linux.ibm.com>
Link: https://lore.kernel.org/r/20210701142221.3408680-3-sth@linux.ibm.comSigned-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 299f2b5f
...@@ -746,7 +746,7 @@ static void create_uid(struct dasd_eckd_private *private) ...@@ -746,7 +746,7 @@ static void create_uid(struct dasd_eckd_private *private)
memcpy(uid->vendor, private->ned->HDA_manufacturer, memcpy(uid->vendor, private->ned->HDA_manufacturer,
sizeof(uid->vendor) - 1); sizeof(uid->vendor) - 1);
EBCASC(uid->vendor, sizeof(uid->vendor) - 1); EBCASC(uid->vendor, sizeof(uid->vendor) - 1);
memcpy(uid->serial, private->ned->HDA_location, memcpy(uid->serial, &private->ned->serial,
sizeof(uid->serial) - 1); sizeof(uid->serial) - 1);
EBCASC(uid->serial, sizeof(uid->serial) - 1); EBCASC(uid->serial, sizeof(uid->serial) - 1);
uid->ssid = private->gneq->subsystemID; uid->ssid = private->gneq->subsystemID;
......
...@@ -332,8 +332,10 @@ struct dasd_ned { ...@@ -332,8 +332,10 @@ struct dasd_ned {
__u8 dev_type[6]; __u8 dev_type[6];
__u8 dev_model[3]; __u8 dev_model[3];
__u8 HDA_manufacturer[3]; __u8 HDA_manufacturer[3];
__u8 HDA_location[2]; struct {
__u8 HDA_seqno[12]; __u8 HDA_location[2];
__u8 HDA_seqno[12];
} serial;
__u8 ID; __u8 ID;
__u8 unit_addr; __u8 unit_addr;
} __attribute__ ((packed)); } __attribute__ ((packed));
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment