Harshit Mogalapalli dae70a5756 VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() ... [ Upstream commit 19b070fefd ] Syzkaller hit 'WARNING in dg_dispatch_as_host' bug. memcpy: detected field-spanning write (size 56) of single field "&dg_info->msg" at drivers/misc/vmw_vmci/vmci_datagram.c:237 (size 24) WARNING: CPU: 0 PID: 1555 at drivers/misc/vmw_vmci/vmci_datagram.c:237 dg_dispatch_as_host+0x88e/0xa60 drivers/misc/vmw_vmci/vmci_datagram.c:237 Some code commentry, based on my understanding: 544 #define VMCI_DG_SIZE(_dg) (VMCI_DG_HEADERSIZE + (size_t)(_dg)->payload_size) /// This is 24 + payload_size memcpy(&dg_info->msg, dg, dg_size); Destination = dg_info->msg ---> this is a 24 byte structure(struct vmci_datagram) Source = dg --> this is a 24 byte structure (struct vmci_datagram) Size = dg_size = 24 + payload_size {payload_size = 56-24 =32} -- Syzkaller managed to set payload_size to 32. 35 struct delayed_datagram_info { 36 struct datagram_entry *entry; 37 struct work_struct work; 38 bool in_dg_host_queue; 39 /* msg and msg_payload must be together. */ 40 struct vmci_datagram msg; 41 u8 msg_payload[]; 42 }; So those extra bytes of payload are copied into msg_payload[], a run time warning is seen while fuzzing with Syzkaller. One possible way to fix the warning is to split the memcpy() into two parts -- one -- direct assignment of msg and second taking care of payload. Gustavo quoted: "Under FORTIFY_SOURCE we should not copy data across multiple members in a structure." Reported-by: syzkaller <syzkaller@googlegroups.com> Suggested-by: Vegard Nossum <vegard.nossum@oracle.com> Suggested-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Reviewed-by: Kees Cook <keescook@chromium.org> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/20240105164001.2129796-2-harshit.m.mogalapalli@oracle.com Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-04-13 13:07:29 +02:00
..
altera-stapl
bcm-vk
c2port
cardreader
cb710
cxl
echo
eeprom
genwqe
ibmasm
lis3lv02d	misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume	2024-04-03 15:28:43 +02:00
lkdtm
mchp_pci1xxxx
mei	mei: me: add arrow lake point H DID	2024-04-03 15:28:43 +02:00
ocxl
pvpanic
sgi-gru
sgi-xp
ti-st
uacce
vmw_vmci	VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()	2024-04-13 13:07:29 +02:00
ad525x_dpot-i2c.c
ad525x_dpot-spi.c
ad525x_dpot.c
ad525x_dpot.h
apds990x.c
apds9802als.c
atmel-ssc.c
bh1770glc.c
cs5535-mfgpt.c
ds1682.c
dummy-irq.c
dw-xdata-pcie.c
enclosure.c
fastrpc.c	misc: fastrpc: Pass proper arguments to scm call	2024-04-03 15:28:43 +02:00
gehc-achc.c
hi6421v600-irq.c
hisi_hikey_usb.c
hmc6352.c
hpilo.c
hpilo.h
ibmvmc.c
ibmvmc.h
ics932s401.c
isl29003.c
isl29020.c
Kconfig
kgdbts.c
lattice-ecp3-config.c
Makefile
open-dice.c	misc: open-dice: Fix spurious lockdep warning	2024-03-01 13:34:51 +01:00
pch_phub.c
pci_endpoint_test.c
phantom.c
qcom-coincell.c
smpro-errmon.c
smpro-misc.c
sram-exec.c
sram.c
sram.h
tifm_7xx1.c
tifm_core.c
tps6594-esm.c
tps6594-pfsm.c
tsl2550.c
vcpu_stall_detector.c
vmw_balloon.c
xilinx_sdfec.c
xilinx_tmr_inject.c
xilinx_tmr_manager.c