On Thu, Oct 27, 2022 at 12:03:07AM +0000, Trond Myklebust wrote: > > > > On Oct 26, 2022, at 19:32, Kees Cook <keescook@xxxxxxxxxxxx> wrote: > > > > On Sun, Oct 16, 2022 at 09:36:50PM -0700, Kees Cook wrote: > >> The 'nfs_server' and 'mount_server' structures include a union of > >> 'struct sockaddr' (with the older 16 bytes max address size) and > >> 'struct sockaddr_storage' which is large enough to hold all the > >> supported sa_family types (128 bytes max size). The runtime memcpy() > >> buffer overflow checker is seeing attempts to write beyond the 16 > >> bytes as an overflow, but the actual expected size is that of 'struct > >> sockaddr_storage'. Plumb the use of 'struct sockaddr_storage' more > >> completely through-out NFS, which results in adjusting the memcpy() > >> buffers to the correct union members. Avoids this false positive run-time > >> warning under CONFIG_FORTIFY_SOURCE: > >> > >> memcpy: detected field-spanning write (size 28) of single field "&ctx->nfs_server.address" at fs/nfs/namespace.c:178 (size 16) > >> > >> Reported-by: kernel test robot <yujie.liu@xxxxxxxxx> > >> Link: https://lore.kernel.org/all/202210110948.26b43120-yujie.liu@xxxxxxxxx > >> Cc: Trond Myklebust <trond.myklebust@xxxxxxxxxxxxxxx> > >> Cc: Anna Schumaker <anna@xxxxxxxxxx> > > > > Friendly ping -- this needs to land in v6.1 to avoid these warnings. > > Should I carry this in the hardening tree instead? > > > > Thanks! > > Anna, this is your call since you’re the ‘6.1 nfs client maintainer’... And just to remind, this came up in -rc1 as well: https://lore.kernel.org/lkml/202210162144.76FBC7271@keescook/ -- Kees Cook
