mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-01 06:33:07 +00:00
d88a0240ff
In order to help the compiler reason about the destination buffer in struct fc_nl_event, add a flexible array member for this purpose. However, since the header is UAPI, it must not change size or layout, so a union is used. The allocation size calculations are also corrected (it was potentially allocating an extra 8 bytes), and the padding is zeroed to avoid leaking kernel heap memory contents. Detected at run-time by the recently added memcpy() bounds checking: memcpy: detected field-spanning write (size 8) of single field "&event->event_data" at drivers/scsi/scsi_transport_fc.c:581 (size 4) Link: https://lore.kernel.org/linux-next/42404B5E-198B-4FD3-94D6-5E16CF579EF3@linux.ibm.com/ Link: https://lore.kernel.org/r/20220921205155.1451649-1-keescook@chromium.org Cc: "James E.J. Bottomley" <jejb@linux.ibm.com> Cc: "Martin K. Petersen" <martin.petersen@oracle.com> Cc: linux-scsi@vger.kernel.org Reported-by: Sachin Sant <sachinp@linux.ibm.com> Tested-by: Sachin Sant <sachinp@linux.ibm.com> Reviewed-by: James Smart <jsmart2021@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
61 lines
1.3 KiB
C
61 lines
1.3 KiB
C
/* SPDX-License-Identifier: GPL-2.0+ WITH Linux-syscall-note */
|
|
/*
|
|
* FC Transport Netlink Interface
|
|
*
|
|
* Copyright (C) 2006 James Smart, Emulex Corporation
|
|
*/
|
|
#ifndef SCSI_NETLINK_FC_H
|
|
#define SCSI_NETLINK_FC_H
|
|
|
|
#include <linux/types.h>
|
|
#include <scsi/scsi_netlink.h>
|
|
|
|
/*
|
|
* This file intended to be included by both kernel and user space
|
|
*/
|
|
|
|
/*
|
|
* FC Transport Message Types
|
|
*/
|
|
/* kernel -> user */
|
|
#define FC_NL_ASYNC_EVENT 0x0100
|
|
/* user -> kernel */
|
|
/* none */
|
|
|
|
|
|
/*
|
|
* Message Structures :
|
|
*/
|
|
|
|
/* macro to round up message lengths to 8byte boundary */
|
|
#define FC_NL_MSGALIGN(len) (((len) + 7) & ~7)
|
|
|
|
|
|
/*
|
|
* FC Transport Broadcast Event Message :
|
|
* FC_NL_ASYNC_EVENT
|
|
*
|
|
* Note: if Vendor Unique message, event_data_flex will be start of
|
|
* vendor unique payload, and the length of the payload is
|
|
* per event_datalen
|
|
*
|
|
* Note: When specifying vendor_id, be sure to read the Vendor Type and ID
|
|
* formatting requirements specified in scsi_netlink.h
|
|
*/
|
|
struct fc_nl_event {
|
|
struct scsi_nl_hdr snlh; /* must be 1st element ! */
|
|
__u64 seconds;
|
|
__u64 vendor_id;
|
|
__u16 host_no;
|
|
__u16 event_datalen;
|
|
__u32 event_num;
|
|
__u32 event_code;
|
|
union {
|
|
__u32 event_data;
|
|
__DECLARE_FLEX_ARRAY(__u8, event_data_flex);
|
|
};
|
|
} __attribute__((aligned(sizeof(__u64))));
|
|
|
|
|
|
#endif /* SCSI_NETLINK_FC_H */
|
|
|