Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

net: Convert struct sockaddr to fixed-size "sa_data[14]" 

Revert struct sockaddr from flexible array to fixed 14-byte "sa_data",
to solve over 36,000 -Wflex-array-member-not-at-end warnings, since
struct sockaddr is embedded within many network structs.

With socket/proto sockaddr-based internal APIs switched to use struct
sockaddr_unsized, there should be no more uses of struct sockaddr that
depend on reading beyond the end of struct sockaddr::sa_data that might
trigger bounds checking.

Comparing an x86_64 "allyesconfig" vmlinux build before and after this
patch showed no new "ud1" instructions from CONFIG_UBSAN_BOUNDS nor any
new "field-spanning" memcpy CONFIG_FORTIFY_SOURCE instrumentations.

Cc: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Kees Cook <kees@kernel.org>
Link: https://patch.msgid.link/20251104002617.2752303-8-kees@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Kees Cook 2025-11-03 16:26:16 -08:00 committed by Jakub Kicinski
parent c1a799eef6
commit 2b5e9f9b7e
6 changed files with 11 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
include/linux/socket.h
View File

@ -32,12 +32,10 @@ typedef __kernel_sa_family_t sa_family_t;
* 1003.1g requires sa_family_t and that sa_data is char. * 1003.1g requires sa_family_t and that sa_data is char.
*/ */
/* Deprecated for in-kernel use. Use struct sockaddr_unsized instead. */
struct sockaddr { struct sockaddr {
sa_family_t sa_family; /* address family, AF_xxx */ sa_family_t sa_family; /* address family, AF_xxx */
union { char sa_data[14]; /* 14 bytes of protocol address */
char sa_data_min[14]; /* Minimum 14 bytes of protocol address */
DECLARE_FLEX_ARRAY(char, sa_data);
};
}; };
/** /**

2
net/core/dev.c
View File

@ -9973,7 +9973,7 @@ DECLARE_RWSEM(dev_addr_sem);
/* "sa" is a true struct sockaddr with limited "sa_data" member. */ /* "sa" is a true struct sockaddr with limited "sa_data" member. */
int netif_get_mac_address(struct sockaddr *sa, struct net *net, char *dev_name) int netif_get_mac_address(struct sockaddr *sa, struct net *net, char *dev_name)
{ {
size_t size = sizeof(sa->sa_data_min); size_t size = sizeof(sa->sa_data);
struct net_device *dev; struct net_device *dev;
int ret = 0; int ret = 0;

2
net/core/dev_ioctl.c
View File

@ -596,7 +596,7 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, void __user *data,
if (ifr->ifr_hwaddr.sa_family != dev->type) if (ifr->ifr_hwaddr.sa_family != dev->type)
return -EINVAL; return -EINVAL;
memcpy(dev->broadcast, ifr->ifr_hwaddr.sa_data, memcpy(dev->broadcast, ifr->ifr_hwaddr.sa_data,
min(sizeof(ifr->ifr_hwaddr.sa_data_min), min(sizeof(ifr->ifr_hwaddr.sa_data),
(size_t)dev->addr_len)); (size_t)dev->addr_len));
netdev_lock_ops(dev); netdev_lock_ops(dev);
call_netdevice_notifiers(NETDEV_CHANGEADDR, dev); call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);

2
net/ipv4/arp.c
View File

@ -1189,7 +1189,7 @@ static int arp_req_get(struct net *net, struct arpreq *r)
read_lock_bh(&neigh->lock); read_lock_bh(&neigh->lock);
memcpy(r->arp_ha.sa_data, neigh->ha, memcpy(r->arp_ha.sa_data, neigh->ha,
min(dev->addr_len, sizeof(r->arp_ha.sa_data_min))); min(dev->addr_len, sizeof(r->arp_ha.sa_data)));
r->arp_flags = arp_state_to_flags(neigh); r->arp_flags = arp_state_to_flags(neigh);
read_unlock_bh(&neigh->lock); read_unlock_bh(&neigh->lock);

10
net/packet/af_packet.c
View File

@ -3284,7 +3284,7 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr_unsized *uaddr,
{ {
struct sock *sk = sock->sk; struct sock *sk = sock->sk;
struct sockaddr *sa = (struct sockaddr *)uaddr; struct sockaddr *sa = (struct sockaddr *)uaddr;
char name[sizeof(sa->sa_data_min) + 1]; char name[sizeof(sa->sa_data) + 1];
/* /*
* Check legality * Check legality
@ -3295,8 +3295,8 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr_unsized *uaddr,
/* uaddr->sa_data comes from the userspace, it's not guaranteed to be /* uaddr->sa_data comes from the userspace, it's not guaranteed to be
* zero-terminated. * zero-terminated.
*/ */
memcpy(name, sa->sa_data, sizeof(sa->sa_data_min)); memcpy(name, sa->sa_data, sizeof(sa->sa_data));
name[sizeof(sa->sa_data_min)] = 0; name[sizeof(sa->sa_data)] = 0;
return packet_do_bind(sk, name, 0, 0); return packet_do_bind(sk, name, 0, 0);
} }
@ -3581,11 +3581,11 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
return -EOPNOTSUPP; return -EOPNOTSUPP;
uaddr->sa_family = AF_PACKET; uaddr->sa_family = AF_PACKET;
memset(uaddr->sa_data, 0, sizeof(uaddr->sa_data_min)); memset(uaddr->sa_data, 0, sizeof(uaddr->sa_data));
rcu_read_lock(); rcu_read_lock();
dev = dev_get_by_index_rcu(sock_net(sk), READ_ONCE(pkt_sk(sk)->ifindex)); dev = dev_get_by_index_rcu(sock_net(sk), READ_ONCE(pkt_sk(sk)->ifindex));
if (dev) if (dev)
strscpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data_min)); strscpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data));
rcu_read_unlock(); rcu_read_unlock();
return sizeof(*uaddr); return sizeof(*uaddr);

5
tools/perf/trace/beauty/include/linux/socket.h
View File

@ -34,10 +34,7 @@ typedef __kernel_sa_family_t sa_family_t;
struct sockaddr { struct sockaddr {
sa_family_t sa_family; /* address family, AF_xxx */ sa_family_t sa_family; /* address family, AF_xxx */
union { char sa_data[14]; /* 14 bytes of protocol address */
char sa_data_min[14]; /* Minimum 14 bytes of protocol address */
DECLARE_FLEX_ARRAY(char, sa_data);
};
}; };
struct linger { struct linger {