LVS
lvs-devel
Google
 
Web LinuxVirtualServer.org

[PATCH nf-next v3 1/4] ipvs: Update width of source for ip_vs_sync_conn_

To: Julian Anastasov <ja@xxxxxx>
Subject: [PATCH nf-next v3 1/4] ipvs: Update width of source for ip_vs_sync_conn_options
Cc: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>, Jozsef Kadlecsik <kadlec@xxxxxxxxxxxxx>, Florian Westphal <fw@xxxxxxxxx>, netdev@xxxxxxxxxxxxxxx, "David S. Miller" <davem@xxxxxxxxxxxxx>, David Ahern <dsahern@xxxxxxxxxx>, Eric Dumazet <edumazet@xxxxxxxxxx>, Jakub Kicinski <kuba@xxxxxxxxxx>, Paolo Abeni <pabeni@xxxxxxxxxx>, lvs-devel@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, netfilter-devel@xxxxxxxxxxxxxxx, coreteam@xxxxxxxxxxxxx, Horatiu Vultur <horatiu.vultur@xxxxxxxxxxxxx>
From: Simon Horman <horms@xxxxxxxxxx>
Date: Mon, 17 Apr 2023 17:10:45 +0200
In ip_vs_sync_conn_v0() copy is made to struct ip_vs_sync_conn_options.
That structure looks like this:

struct ip_vs_sync_conn_options {
        struct ip_vs_seq        in_seq;
        struct ip_vs_seq        out_seq;
};

The source of the copy is the in_seq field of struct ip_vs_conn.  Whose
type is struct ip_vs_seq. Thus we can see that the source - is not as
wide as the amount of data copied, which is the width of struct
ip_vs_sync_conn_option.

The copy is safe because the next field in is another struct ip_vs_seq.
Make use of struct_group() to annotate this.

Flagged by gcc-13 as:

 In file included from ./include/linux/string.h:254,
                  from ./include/linux/bitmap.h:11,
                  from ./include/linux/cpumask.h:12,
                  from ./arch/x86/include/asm/paravirt.h:17,
                  from ./arch/x86/include/asm/cpuid.h:62,
                  from ./arch/x86/include/asm/processor.h:19,
                  from ./arch/x86/include/asm/timex.h:5,
                  from ./include/linux/timex.h:67,
                  from ./include/linux/time32.h:13,
                  from ./include/linux/time.h:60,
                  from ./include/linux/stat.h:19,
                  from ./include/linux/module.h:13,
                  from net/netfilter/ipvs/ip_vs_sync.c:38:
 In function 'fortify_memcpy_chk',
     inlined from 'ip_vs_sync_conn_v0' at net/netfilter/ipvs/ip_vs_sync.c:606:3:
 ./include/linux/fortify-string.h:529:25: error: call to 
'__read_overflow2_field' declared with attribute warning: detected read beyond 
size of field (2nd parameter); maybe use struct_group()? 
[-Werror=attribute-warning]
   529 |                         __read_overflow2_field(q_size_field, size);
       |

Compile tested only.

Signed-off-by: Simon Horman <horms@xxxxxxxxxx>
Reviewed-by: Horatiu Vultur <horatiu.vultur@xxxxxxxxxxxxx>
---
v3
- Add Horatiu's Reviewed-by tag
v2
- Correct spelling of 'conn' in subject
- No change
---
 include/net/ip_vs.h             | 6 ++++--
 net/netfilter/ipvs/ip_vs_sync.c | 2 +-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 6d71a5ff52df..e20f1f92066d 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -630,8 +630,10 @@ struct ip_vs_conn {
         */
        struct ip_vs_app        *app;           /* bound ip_vs_app object */
        void                    *app_data;      /* Application private data */
-       struct ip_vs_seq        in_seq;         /* incoming seq. struct */
-       struct ip_vs_seq        out_seq;        /* outgoing seq. struct */
+       struct_group(sync_conn_opt,
+               struct ip_vs_seq  in_seq;       /* incoming seq. struct */
+               struct ip_vs_seq  out_seq;      /* outgoing seq. struct */
+       );
 
        const struct ip_vs_pe   *pe;
        char                    *pe_data;
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index 4963fec815da..d4fe7bb4f853 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -603,7 +603,7 @@ static void ip_vs_sync_conn_v0(struct netns_ipvs *ipvs, 
struct ip_vs_conn *cp,
        if (cp->flags & IP_VS_CONN_F_SEQ_MASK) {
                struct ip_vs_sync_conn_options *opt =
                        (struct ip_vs_sync_conn_options *)&s[1];
-               memcpy(opt, &cp->in_seq, sizeof(*opt));
+               memcpy(opt, &cp->sync_conn_opt, sizeof(*opt));
        }
 
        m->nr_conns++;

-- 
2.30.2


<Prev in Thread] Current Thread [Next in Thread>