summaryrefslogtreecommitdiff
path: root/include/uapi/scsi
diff options
context:
space:
mode:
authorKees Cook <keescook@chromium.org>2022-09-21 23:51:55 +0300
committerMartin K. Petersen <martin.petersen@oracle.com>2022-09-25 19:52:48 +0300
commitd88a0240ff76062eb0728963e7aacf6dbe87f7c7 (patch)
tree363ed7c30318045053e57b0cbc77e73416fa2b0d /include/uapi/scsi
parent1a2433b0ec45acd71130bd0bf419394c7d7d85c0 (diff)
downloadlinux-d88a0240ff76062eb0728963e7aacf6dbe87f7c7.tar.xz
scsi: scsi_transport_fc: Adjust struct fc_nl_event flex array usage
In order to help the compiler reason about the destination buffer in struct fc_nl_event, add a flexible array member for this purpose. However, since the header is UAPI, it must not change size or layout, so a union is used. The allocation size calculations are also corrected (it was potentially allocating an extra 8 bytes), and the padding is zeroed to avoid leaking kernel heap memory contents. Detected at run-time by the recently added memcpy() bounds checking: memcpy: detected field-spanning write (size 8) of single field "&event->event_data" at drivers/scsi/scsi_transport_fc.c:581 (size 4) Link: https://lore.kernel.org/linux-next/42404B5E-198B-4FD3-94D6-5E16CF579EF3@linux.ibm.com/ Link: https://lore.kernel.org/r/20220921205155.1451649-1-keescook@chromium.org Cc: "James E.J. Bottomley" <jejb@linux.ibm.com> Cc: "Martin K. Petersen" <martin.petersen@oracle.com> Cc: linux-scsi@vger.kernel.org Reported-by: Sachin Sant <sachinp@linux.ibm.com> Tested-by: Sachin Sant <sachinp@linux.ibm.com> Reviewed-by: James Smart <jsmart2021@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'include/uapi/scsi')
-rw-r--r--include/uapi/scsi/scsi_netlink_fc.h7
1 files changed, 5 insertions, 2 deletions
diff --git a/include/uapi/scsi/scsi_netlink_fc.h b/include/uapi/scsi/scsi_netlink_fc.h
index 7535253f1a96..b46e9cbeb001 100644
--- a/include/uapi/scsi/scsi_netlink_fc.h
+++ b/include/uapi/scsi/scsi_netlink_fc.h
@@ -35,7 +35,7 @@
* FC Transport Broadcast Event Message :
* FC_NL_ASYNC_EVENT
*
- * Note: if Vendor Unique message, &event_data will be start of
+ * Note: if Vendor Unique message, event_data_flex will be start of
* vendor unique payload, and the length of the payload is
* per event_datalen
*
@@ -50,7 +50,10 @@ struct fc_nl_event {
__u16 event_datalen;
__u32 event_num;
__u32 event_code;
- __u32 event_data;
+ union {
+ __u32 event_data;
+ __DECLARE_FLEX_ARRAY(__u8, event_data_flex);
+ };
} __attribute__((aligned(sizeof(__u64))));