Patch "wireguard: netlink: avoid variable-sized memcpy on sockaddr" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    wireguard: netlink: avoid variable-sized memcpy on sockaddr

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     wireguard-netlink-avoid-variable-sized-memcpy-on-soc.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 840e8e4e92e78bbb168dadbbcd724f29aecc1853
Author: Jason A. Donenfeld <Jason@xxxxxxxxx>
Date:   Fri Sep 16 15:37:40 2022 +0100

    wireguard: netlink: avoid variable-sized memcpy on sockaddr
    
    [ Upstream commit 26c013108c12b94bc023bf19198a4300596c98b1 ]
    
    Doing a variable-sized memcpy is slower, and the compiler isn't smart
    enough to turn this into a constant-size assignment.
    
    Further, Kees' latest fortified memcpy will actually bark, because the
    destination pointer is type sockaddr, not explicitly sockaddr_in or
    sockaddr_in6, so it thinks there's an overflow:
    
        memcpy: detected field-spanning write (size 28) of single field
        "&endpoint.addr" at drivers/net/wireguard/netlink.c:446 (size 16)
    
    Fix this by just assigning by using explicit casts for each checked
    case.
    
    Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
    Signed-off-by: Jason A. Donenfeld <Jason@xxxxxxxxx>
    Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>
    Reported-by: syzbot+a448cda4dba2dac50de5@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/wireguard/netlink.c b/drivers/net/wireguard/netlink.c
index d0f3b6d7f408..5c804bcabfe6 100644
--- a/drivers/net/wireguard/netlink.c
+++ b/drivers/net/wireguard/netlink.c
@@ -436,14 +436,13 @@ static int set_peer(struct wg_device *wg, struct nlattr **attrs)
 	if (attrs[WGPEER_A_ENDPOINT]) {
 		struct sockaddr *addr = nla_data(attrs[WGPEER_A_ENDPOINT]);
 		size_t len = nla_len(attrs[WGPEER_A_ENDPOINT]);
+		struct endpoint endpoint = { { { 0 } } };
 
-		if ((len == sizeof(struct sockaddr_in) &&
-		     addr->sa_family == AF_INET) ||
-		    (len == sizeof(struct sockaddr_in6) &&
-		     addr->sa_family == AF_INET6)) {
-			struct endpoint endpoint = { { { 0 } } };
-
-			memcpy(&endpoint.addr, addr, len);
+		if (len == sizeof(struct sockaddr_in) && addr->sa_family == AF_INET) {
+			endpoint.addr4 = *(struct sockaddr_in *)addr;
+			wg_socket_set_peer_endpoint(peer, &endpoint);
+		} else if (len == sizeof(struct sockaddr_in6) && addr->sa_family == AF_INET6) {
+			endpoint.addr6 = *(struct sockaddr_in6 *)addr;
 			wg_socket_set_peer_endpoint(peer, &endpoint);
 		}
 	}