As we continue to narrow the scope of what the FORTIFY memcpy() will
accept and build alternative APIs that give the compiler appropriate
visibility into more complex memcpy scenarios, there is a need for
"unfortified" memcpy use in rare cases where combinations of compiler
behaviors, source code layout, etc, result in cases where the stricter
memcpy checks need to be bypassed until appropriate solutions can be
developed (i.e. fix compiler bugs, code refactoring, new API, etc). The
intention is for this to be used only if there's no other reasonable
solution, for its use to include a justification that can be used
to assess future solutions, and for it to be temporary.
Example usage included, based on analysis and discussion from:
https://lore.kernel.org/netdev/CANn89iLS_2cshtuXPyNUGDPaic=sJiYfvTb_wNLgWrZRyBxZ_g@mail.gmail.com
Cc: Jakub Kicinski <[email protected]>
Cc: Eric Dumazet <[email protected]>
Cc: "David S. Miller" <[email protected]>
Cc: Paolo Abeni <[email protected]>
Cc: Coco Li <[email protected]>
Cc: Tariq Toukan <[email protected]>
Cc: Saeed Mahameed <[email protected]>
Cc: Leon Romanovsky <[email protected]>
Cc: [email protected]
Cc: [email protected]
Signed-off-by: Kees Cook <[email protected]>
---
drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 8 +++++++-
include/linux/fortify-string.h | 16 ++++++++++++++++
include/linux/string.h | 4 ++++
3 files changed, 27 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index 2dc48406cd08..5855d8f9c509 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -386,7 +386,13 @@ mlx5e_sq_xmit_wqe(struct mlx5e_txqsq *sq, struct sk_buff *skb,
stats->added_vlan_packets++;
} else {
eseg->inline_hdr.sz |= cpu_to_be16(attr->ihs);
- memcpy(eseg->inline_hdr.start, skb->data, attr->ihs);
+ unsafe_memcpy(eseg->inline_hdr.start, skb->data, attr->ihs,
+ /* This copy has been bounds-checked earlier in
+ * mlx5i_sq_calc_wqe_attr() and intentionally
+ * crosses a flex array boundary. Since it is
+ * performance sensitive, splitting the copy is
+ * undesirable.
+ */);
}
dseg += wqe_attr->ds_cnt_inl;
} else if (skb_vlan_tag_present(skb)) {
diff --git a/include/linux/fortify-string.h b/include/linux/fortify-string.h
index 295637a66c46..3b401fa0f374 100644
--- a/include/linux/fortify-string.h
+++ b/include/linux/fortify-string.h
@@ -52,6 +52,22 @@ extern char *__underlying_strncpy(char *p, const char *q, __kernel_size_t size)
#define __underlying_strncpy __builtin_strncpy
#endif
+/**
+ * unsafe_memcpy - memcpy implementation with no FORTIFY bounds checking
+ *
+ * @dst: Destination memory address to write to
+ * @src: Source memory address to read from
+ * @bytes: How many bytes to write to @dst from @src
+ * @justification: Free-form text or comment describing why the use is needed
+ *
+ * This should be used for corner cases where the compiler cannot do the
+ * right thing, or during transitions between APIs, etc. It should be used
+ * very rarely, and includes a place for justification detailing where bounds
+ * checking has happened, and why existing solutions cannot be employed.
+ */
+#define unsafe_memcpy(dst, src, bytes, justification) \
+ __underlying_memcpy(dst, src, bytes)
+
/*
* Clang's use of __builtin_object_size() within inlines needs hinting via
* __pass_object_size(). The preference is to only ever use type 1 (member
diff --git a/include/linux/string.h b/include/linux/string.h
index b6572aeca2f5..61ec7e4f6311 100644
--- a/include/linux/string.h
+++ b/include/linux/string.h
@@ -252,6 +252,10 @@ static inline const char *kbasename(const char *path)
#if !defined(__NO_FORTIFY) && defined(__OPTIMIZE__) && defined(CONFIG_FORTIFY_SOURCE)
#include <linux/fortify-string.h>
#endif
+#ifndef unsafe_memcpy
+#define unsafe_memcpy(dst, src, bytes, justification) \
+ memcpy(dst, src, bytes)
+#endif
void memcpy_and_pad(void *dest, size_t dest_len, const void *src, size_t count,
int pad);
--
2.32.0
On Tue, 10 May 2022 19:53:01 -0700 Kees Cook wrote:
> As we continue to narrow the scope of what the FORTIFY memcpy() will
> accept and build alternative APIs that give the compiler appropriate
> visibility into more complex memcpy scenarios, there is a need for
> "unfortified" memcpy use in rare cases where combinations of compiler
> behaviors, source code layout, etc, result in cases where the stricter
> memcpy checks need to be bypassed until appropriate solutions can be
> developed (i.e. fix compiler bugs, code refactoring, new API, etc). The
> intention is for this to be used only if there's no other reasonable
> solution, for its use to include a justification that can be used
> to assess future solutions, and for it to be temporary.
>
> Example usage included, based on analysis and discussion from:
> https://lore.kernel.org/netdev/CANn89iLS_2cshtuXPyNUGDPaic=sJiYfvTb_wNLgWrZRyBxZ_g@mail.gmail.com
Saeed, ack for taking this in directly? Or do you prefer to take this
plus Eric's last BIG TCP patch via your tree?
On 11 May 09:24, Jakub Kicinski wrote:
>On Tue, 10 May 2022 19:53:01 -0700 Kees Cook wrote:
>> As we continue to narrow the scope of what the FORTIFY memcpy() will
>> accept and build alternative APIs that give the compiler appropriate
>> visibility into more complex memcpy scenarios, there is a need for
>> "unfortified" memcpy use in rare cases where combinations of compiler
>> behaviors, source code layout, etc, result in cases where the stricter
>> memcpy checks need to be bypassed until appropriate solutions can be
>> developed (i.e. fix compiler bugs, code refactoring, new API, etc). The
>> intention is for this to be used only if there's no other reasonable
>> solution, for its use to include a justification that can be used
>> to assess future solutions, and for it to be temporary.
>>
>> Example usage included, based on analysis and discussion from:
>> https://lore.kernel.org/netdev/CANn89iLS_2cshtuXPyNUGDPaic=sJiYfvTb_wNLgWrZRyBxZ_g@mail.gmail.com
>
>Saeed, ack for taking this in directly? Or do you prefer to take this
>plus Eric's last BIG TCP patch via your tree?
Please take both, I asked Eric a question on the BIG TCP patch, but I
won't block the series.
Thanks!
Hello:
This patch was applied to netdev/net-next.git (master)
by Paolo Abeni <[email protected]>:
On Tue, 10 May 2022 19:53:01 -0700 you wrote:
> As we continue to narrow the scope of what the FORTIFY memcpy() will
> accept and build alternative APIs that give the compiler appropriate
> visibility into more complex memcpy scenarios, there is a need for
> "unfortified" memcpy use in rare cases where combinations of compiler
> behaviors, source code layout, etc, result in cases where the stricter
> memcpy checks need to be bypassed until appropriate solutions can be
> developed (i.e. fix compiler bugs, code refactoring, new API, etc). The
> intention is for this to be used only if there's no other reasonable
> solution, for its use to include a justification that can be used
> to assess future solutions, and for it to be temporary.
>
> [...]
Here is the summary with links:
- fortify: Provide a memcpy trap door for sharp corners
https://git.kernel.org/netdev/net-next/c/43213daed6d6
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html