Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Laura Abbott <labbott@redhat.com>
To:     Pablo Neira Ayuso <pablo@netfilter.org>,
        Jozsef Kadlecsik <kadlec@netfilter.org>,
        Florian Westphal <fw@strlen.de>,
        "David S. Miller" <davem@davemloft.net>
Cc:     Laura Abbott <labbott@redhat.com>, netfilter-devel@vger.kernel.org,
        coreteam@netfilter.org, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org, Kees Cook <keescook@chromium.org>
Subject: [PATCH] netfilter: nf_flow_table_offload: Correct memcpy size for flow_overload_mangle
Date:   Tue,  3 Dec 2019 11:03:45 -0500
Message-Id: <20191203160345.24743-1-labbott@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

The sizes for memcpy in flow_offload_mangle don't match
the source variables, leading to overflow errors on some
build configurations:

In function 'memcpy',
    inlined from 'flow_offload_mangle' at net/netfilter/nf_flow_table_offlo=
ad.c:112:2,
    inlined from 'flow_offload_port_dnat' at net/netfilter/nf_flow_table_of=
fload.c:373:2,
    inlined from 'nf_flow_rule_route_ipv4' at net/netfilter/nf_flow_table_o=
ffload.c:424:3:
./include/linux/string.h:376:4: error: call to '__read_overflow2' declared =
with attribute error: detected read beyond size of object passed as 2nd par=
ameter
  376 |    __read_overflow2();
      |    ^~~~~~~~~~~~~~~~~~
make[2]: *** [scripts/Makefile.build:266: net/netfilter/nf_flow_table_offlo=
ad.o] Error 1

Fix this by using the corresponding type.

Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
Signed-off-by: Laura Abbott <labbott@redhat.com>
---
Seen on a Fedora powerpc little endian build with -O3 but it looks like
it is correctly catching an error with doing a memcpy outside the source
variable.
---
 net/netfilter/nf_flow_table_offload.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_=
table_offload.c
index c54c9a6cc981..526f894d0bdb 100644
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -108,8 +108,8 @@ static void flow_offload_mangle(struct flow_action_entr=
y *entry,
 =09entry->id =3D FLOW_ACTION_MANGLE;
 =09entry->mangle.htype =3D htype;
 =09entry->mangle.offset =3D offset;
-=09memcpy(&entry->mangle.mask, mask, sizeof(u32));
-=09memcpy(&entry->mangle.val, value, sizeof(u32));
+=09memcpy(&entry->mangle.mask, mask, sizeof(u8));
+=09memcpy(&entry->mangle.val, value, sizeof(u8));
 }
=20
 static inline struct flow_action_entry *
--=20
2.21.0