scsi: scsi_transport_fc: Adjust struct fc_nl_event flex array usage
authorKees Cook <keescook@chromium.org>
Wed, 21 Sep 2022 20:51:55 +0000 (13:51 -0700)
committerMartin K. Petersen <martin.petersen@oracle.com>
Sun, 25 Sep 2022 16:52:48 +0000 (12:52 -0400)
commitd88a0240ff76062eb0728963e7aacf6dbe87f7c7
tree363ed7c30318045053e57b0cbc77e73416fa2b0d
parent1a2433b0ec45acd71130bd0bf419394c7d7d85c0
scsi: scsi_transport_fc: Adjust struct fc_nl_event flex array usage

In order to help the compiler reason about the destination buffer in struct
fc_nl_event, add a flexible array member for this purpose.  However, since
the header is UAPI, it must not change size or layout, so a union is used.

The allocation size calculations are also corrected (it was potentially
allocating an extra 8 bytes), and the padding is zeroed to avoid leaking
kernel heap memory contents.

Detected at run-time by the recently added memcpy() bounds checking:

  memcpy: detected field-spanning write (size 8) of single field "&event->event_data" at drivers/scsi/scsi_transport_fc.c:581 (size 4)

Link: https://lore.kernel.org/linux-next/42404B5E-198B-4FD3-94D6-5E16CF579EF3@linux.ibm.com/
Link: https://lore.kernel.org/r/20220921205155.1451649-1-keescook@chromium.org
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: linux-scsi@vger.kernel.org
Reported-by: Sachin Sant <sachinp@linux.ibm.com>
Tested-by: Sachin Sant <sachinp@linux.ibm.com>
Reviewed-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/scsi_transport_fc.c
include/uapi/scsi/scsi_netlink_fc.h