scsi: scsi_transport_fc: Adjust struct fc_nl_event flex array usage

In order to help the compiler reason about the destination buffer in struct fc_nl_event, add a flexible array member for this purpose. However, since the header is UAPI, it must not change size or layout, so a union is used. The allocation size calculations are also corrected (it was potentially allocating an extra 8 bytes), and the padding is zeroed to avoid leaking kernel heap memory contents. Detected at run-time by the recently added memcpy() bounds checking: memcpy: detected field-spanning write (size 8) of single field "&event->event_data" at drivers/scsi/scsi_transport_fc.c:581 (size 4)

Kees Cook committed 4 years ago

Commit d88a0241 parent 1a2433b2 files · +10 −5Browse files

Showing the changes to include/uapi (1 of 2 files). Show all

Unified · Split

include/uapi/scsi/scsi_netlink_fc.h+5−2

@@ -35,7 +35,7 @@ · 34 unmodified lines
35	35	* FC Transport Broadcast Event Message :
36	36	* FC_NL_ASYNC_EVENT
37	37	*
38		− * Note: if Vendor Unique message, &event_data will be start of
	38	+ * Note: if Vendor Unique message, event_data_flex will be start of
39	39	* vendor unique payload, and the length of the payload is
40	40	* per event_datalen
41	41	*
@@ -50,7 +50,10 @@ struct fc_nl_event { · 8 unmodified lines
50	50	__u16 event_datalen;
51	51	__u32 event_num;
52	52	__u32 event_code;
53		− __u32 event_data;
	53	+ union {
	54	+ __u32 event_data;
	55	+ __DECLARE_FLEX_ARRAY(__u8, event_data_flex);
	56	+ };
54	57	} __attribute__((aligned(sizeof(__u64))));
55	58
56	59