Commit 2b5e9f9b authored by Kees Cook's avatar Kees Cook Committed by Jakub Kicinski
Browse files

net: Convert struct sockaddr to fixed-size "sa_data[14]" 



Revert struct sockaddr from flexible array to fixed 14-byte "sa_data",
to solve over 36,000 -Wflex-array-member-not-at-end warnings, since
struct sockaddr is embedded within many network structs.

With socket/proto sockaddr-based internal APIs switched to use struct
sockaddr_unsized, there should be no more uses of struct sockaddr that
depend on reading beyond the end of struct sockaddr::sa_data that might
trigger bounds checking.

Comparing an x86_64 "allyesconfig" vmlinux build before and after this
patch showed no new "ud1" instructions from CONFIG_UBSAN_BOUNDS nor any
new "field-spanning" memcpy CONFIG_FORTIFY_SOURCE instrumentations.

Cc: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: default avatarKees Cook <kees@kernel.org>
Link: https://patch.msgid.link/20251104002617.2752303-8-kees@kernel.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent c1a799ee

include/linux/socket.h

+2 −4
Original line number Diff line number Diff line
@@ -32,12 +32,10 @@ typedef __kernel_sa_family_t sa_family_t; 
 *	1003.1g requires sa_family_t and that sa_data is char.

 */



/* Deprecated for in-kernel use. Use struct sockaddr_unsized instead. */

struct sockaddr {

	sa_family_t	sa_family;	/* address family, AF_xxx	*/

	union {

		char sa_data_min[14];		/* Minimum 14 bytes of protocol address	*/

		DECLARE_FLEX_ARRAY(char, sa_data);

	};

	char		sa_data[14];	/* 14 bytes of protocol address	*/

};



/**

net/core/dev.c

+1 −1
Original line number Diff line number Diff line
@@ -9973,7 +9973,7 @@ DECLARE_RWSEM(dev_addr_sem); 
/* "sa" is a true struct sockaddr with limited "sa_data" member. */

int netif_get_mac_address(struct sockaddr *sa, struct net *net, char *dev_name)

{

	size_t size = sizeof(sa->sa_data_min);

	size_t size = sizeof(sa->sa_data);

	struct net_device *dev;

	int ret = 0;

net/core/dev_ioctl.c

+1 −1
Original line number Diff line number Diff line
@@ -596,7 +596,7 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, void __user *data, 
		if (ifr->ifr_hwaddr.sa_family != dev->type)

			return -EINVAL;

		memcpy(dev->broadcast, ifr->ifr_hwaddr.sa_data,

		       min(sizeof(ifr->ifr_hwaddr.sa_data_min),

		       min(sizeof(ifr->ifr_hwaddr.sa_data),

			   (size_t)dev->addr_len));

		netdev_lock_ops(dev);

		call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);

net/ipv4/arp.c

+1 −1
Original line number Diff line number Diff line
@@ -1189,7 +1189,7 @@ static int arp_req_get(struct net *net, struct arpreq *r) 


	read_lock_bh(&neigh->lock);

	memcpy(r->arp_ha.sa_data, neigh->ha,

	       min(dev->addr_len, sizeof(r->arp_ha.sa_data_min)));

	       min(dev->addr_len, sizeof(r->arp_ha.sa_data)));

	r->arp_flags = arp_state_to_flags(neigh);

	read_unlock_bh(&neigh->lock);

net/packet/af_packet.c

+5 −5
Original line number Diff line number Diff line
@@ -3284,7 +3284,7 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr_unsized *uaddr, 
{

	struct sock *sk = sock->sk;

	struct sockaddr *sa = (struct sockaddr *)uaddr;

	char name[sizeof(sa->sa_data_min) + 1];

	char name[sizeof(sa->sa_data) + 1];



	/*

	 *	Check legality
@@ -3295,8 +3295,8 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr_unsized *uaddr, 
	/* uaddr->sa_data comes from the userspace, it's not guaranteed to be

	 * zero-terminated.

	 */

	memcpy(name, sa->sa_data, sizeof(sa->sa_data_min));

	name[sizeof(sa->sa_data_min)] = 0;

	memcpy(name, sa->sa_data, sizeof(sa->sa_data));

	name[sizeof(sa->sa_data)] = 0;



	return packet_do_bind(sk, name, 0, 0);

}
@@ -3581,11 +3581,11 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr, 
		return -EOPNOTSUPP;



	uaddr->sa_family = AF_PACKET;

	memset(uaddr->sa_data, 0, sizeof(uaddr->sa_data_min));

	memset(uaddr->sa_data, 0, sizeof(uaddr->sa_data));

	rcu_read_lock();

	dev = dev_get_by_index_rcu(sock_net(sk), READ_ONCE(pkt_sk(sk)->ifindex));

	if (dev)

		strscpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data_min));

		strscpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data));

	rcu_read_unlock();



	return sizeof(*uaddr);