NFS: Avoid memcpy() run-time warning for struct sockaddr overflows
authorKees Cook <keescook@chromium.org>
Mon, 17 Oct 2022 04:36:50 +0000 (21:36 -0700)
committerAnna Schumaker <Anna.Schumaker@Netapp.com>
Thu, 27 Oct 2022 19:52:10 +0000 (15:52 -0400)
commitcf0d7e7f4520814f45e1313872ad5777ed504004
treee5bdb30c9297ff31dcd7ea93925008864763d8d2
parent121affdf8a940555ceef6ab10a709030e52a4f91
NFS: Avoid memcpy() run-time warning for struct sockaddr overflows

The 'nfs_server' and 'mount_server' structures include a union of
'struct sockaddr' (with the older 16 bytes max address size) and
'struct sockaddr_storage' which is large enough to hold all the
supported sa_family types (128 bytes max size). The runtime memcpy()
buffer overflow checker is seeing attempts to write beyond the 16
bytes as an overflow, but the actual expected size is that of 'struct
sockaddr_storage'. Plumb the use of 'struct sockaddr_storage' more
completely through-out NFS, which results in adjusting the memcpy()
buffers to the correct union members. Avoids this false positive run-time
warning under CONFIG_FORTIFY_SOURCE:

  memcpy: detected field-spanning write (size 28) of single field "&ctx->nfs_server.address" at fs/nfs/namespace.c:178 (size 16)

Reported-by: kernel test robot <yujie.liu@intel.com>
Link: https://lore.kernel.org/all/202210110948.26b43120-yujie.liu@intel.com
Cc: Trond Myklebust <trond.myklebust@hammerspace.com>
Cc: Anna Schumaker <anna@kernel.org>
Cc: linux-nfs@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
14 files changed:
fs/nfs/client.c
fs/nfs/dns_resolve.c
fs/nfs/dns_resolve.h
fs/nfs/fs_context.c
fs/nfs/internal.h
fs/nfs/mount_clnt.c
fs/nfs/namespace.c
fs/nfs/nfs3client.c
fs/nfs/nfs4_fs.h
fs/nfs/nfs4client.c
fs/nfs/nfs4namespace.c
fs/nfs/nfs4proc.c
fs/nfs/pnfs_nfs.c
fs/nfs/super.c