The 04/11/2023 09:10, Simon Horman wrote:
>
> In ip_vs_sync_conn_v0() copy is made to struct ip_vs_sync_conn_options.
> That structure looks like this:
>
> struct ip_vs_sync_conn_options {
> struct ip_vs_seq in_seq;
> struct ip_vs_seq out_seq;
> };
>
> The source of the copy is the in_seq field of struct ip_vs_conn. Whose
> type is struct ip_vs_seq. Thus we can see that the source - is not as
> wide as the amount of data copied, which is the width of struct
> ip_vs_sync_conn_option.
>
> The copy is safe because the next field in is another struct ip_vs_seq.
> Make use of struct_group() to annotate this.
>
> Flagged by gcc-13 as:
>
> In file included from ./include/linux/string.h:254,
> from ./include/linux/bitmap.h:11,
> from ./include/linux/cpumask.h:12,
> from ./arch/x86/include/asm/paravirt.h:17,
> from ./arch/x86/include/asm/cpuid.h:62,
> from ./arch/x86/include/asm/processor.h:19,
> from ./arch/x86/include/asm/timex.h:5,
> from ./include/linux/timex.h:67,
> from ./include/linux/time32.h:13,
> from ./include/linux/time.h:60,
> from ./include/linux/stat.h:19,
> from ./include/linux/module.h:13,
> from net/netfilter/ipvs/ip_vs_sync.c:38:
> In function 'fortify_memcpy_chk',
> inlined from 'ip_vs_sync_conn_v0' at net/netfilter/ipvs/ip_vs_sync.c:606:3:
> ./include/linux/fortify-string.h:529:25: error: call to '__read_overflow2_field' declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror=attribute-warning]
> 529 | __read_overflow2_field(q_size_field, size);
> |
>
> Compile tested only.
Reviewed-by: Horatiu Vultur <horatiu.vultur@xxxxxxxxxxxxx>
>
> Signed-off-by: Simon Horman <horms@xxxxxxxxxx>
> ---
> v2
> * Correct spelling of 'conn' in subject
> ---
> include/net/ip_vs.h | 6 ++++--
> net/netfilter/ipvs/ip_vs_sync.c | 2 +-
> 2 files changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
> index 6d71a5ff52df..e20f1f92066d 100644
> --- a/include/net/ip_vs.h
> +++ b/include/net/ip_vs.h
> @@ -630,8 +630,10 @@ struct ip_vs_conn {
> */
> struct ip_vs_app *app; /* bound ip_vs_app object */
> void *app_data; /* Application private data */
> - struct ip_vs_seq in_seq; /* incoming seq. struct */
> - struct ip_vs_seq out_seq; /* outgoing seq. struct */
> + struct_group(sync_conn_opt,
> + struct ip_vs_seq in_seq; /* incoming seq. struct */
> + struct ip_vs_seq out_seq; /* outgoing seq. struct */
> + );
>
> const struct ip_vs_pe *pe;
> char *pe_data;
> diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
> index 4963fec815da..d4fe7bb4f853 100644
> --- a/net/netfilter/ipvs/ip_vs_sync.c
> +++ b/net/netfilter/ipvs/ip_vs_sync.c
> @@ -603,7 +603,7 @@ static void ip_vs_sync_conn_v0(struct netns_ipvs *ipvs, struct ip_vs_conn *cp,
> if (cp->flags & IP_VS_CONN_F_SEQ_MASK) {
> struct ip_vs_sync_conn_options *opt =
> (struct ip_vs_sync_conn_options *)&s[1];
> - memcpy(opt, &cp->in_seq, sizeof(*opt));
> + memcpy(opt, &cp->sync_conn_opt, sizeof(*opt));
> }
>
> m->nr_conns++;
>
> --
> 2.30.2
>
--
/Horatiu
