Patch "af_packet: Fix fortified memcpy() without flex array." has been added to the 6.5-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    af_packet: Fix fortified memcpy() without flex array.

to the 6.5-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     af_packet-fix-fortified-memcpy-without-flex-array.patch
and it can be found in the queue-6.5 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 03d133a6ce93a4cbb8982e734d1909b5faaa3910
Author: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
Date:   Mon Oct 9 08:31:52 2023 -0700

    af_packet: Fix fortified memcpy() without flex array.
    
    [ Upstream commit e2bca4870fdaf855651ee80b083d892599c5d982 ]
    
    Sergei Trofimovich reported a regression [0] caused by commit a0ade8404c3b
    ("af_packet: Fix warning of fortified memcpy() in packet_getname().").
    
    It introduced a flex array sll_addr_flex in struct sockaddr_ll as a
    union-ed member with sll_addr to work around the fortified memcpy() check.
    
    However, a userspace program uses a struct that has struct sockaddr_ll in
    the middle, where a flex array is illegal to exist.
    
      include/linux/if_packet.h:24:17: error: flexible array member 'sockaddr_ll::<unnamed union>::<unnamed struct>::sll_addr_flex' not at end of 'struct packet_info_t'
         24 |                 __DECLARE_FLEX_ARRAY(unsigned char, sll_addr_flex);
            |                 ^~~~~~~~~~~~~~~~~~~~
    
    To fix the regression, let's go back to the first attempt [1] telling
    memcpy() the actual size of the array.
    
    Reported-by: Sergei Trofimovich <slyich@xxxxxxxxx>
    Closes: https://github.com/NixOS/nixpkgs/pull/252587#issuecomment-1741733002 [0]
    Link: https://lore.kernel.org/netdev/20230720004410.87588-3-kuniyu@xxxxxxxxxx/ [1]
    Fixes: a0ade8404c3b ("af_packet: Fix warning of fortified memcpy() in packet_getname().")
    Signed-off-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20231009153151.75688-1-kuniyu@xxxxxxxxxx
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/include/uapi/linux/if_packet.h b/include/uapi/linux/if_packet.h
index 4d0ad22f83b56..9efc42382fdb9 100644
--- a/include/uapi/linux/if_packet.h
+++ b/include/uapi/linux/if_packet.h
@@ -18,11 +18,7 @@ struct sockaddr_ll {
 	unsigned short	sll_hatype;
 	unsigned char	sll_pkttype;
 	unsigned char	sll_halen;
-	union {
-		unsigned char	sll_addr[8];
-		/* Actual length is in sll_halen. */
-		__DECLARE_FLEX_ARRAY(unsigned char, sll_addr_flex);
-	};
+	unsigned char	sll_addr[8];
 };
 
 /* Packet types */
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index a2935bd18ed98..a39b2a0dd5425 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3605,7 +3605,12 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
 	if (dev) {
 		sll->sll_hatype = dev->type;
 		sll->sll_halen = dev->addr_len;
-		memcpy(sll->sll_addr_flex, dev->dev_addr, dev->addr_len);
+
+		/* Let __fortify_memcpy_chk() know the actual buffer size. */
+		memcpy(((struct sockaddr_storage *)sll)->__data +
+		       offsetof(struct sockaddr_ll, sll_addr) -
+		       offsetofend(struct sockaddr_ll, sll_family),
+		       dev->dev_addr, dev->addr_len);
 	} else {
 		sll->sll_hatype = 0;	/* Bad: we have no ARPHRD_UNSPEC */
 		sll->sll_halen = 0;