Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Sun, 16 Oct 2022 21:57:59 -0700
From:   Kees Cook <keescook@chromium.org>
To:     Dave Jones <davej@codemonkey.org.uk>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        Trond Myklebust <trond.myklebust@hammerspace.com>,
        Anna Schumaker <anna@kernel.org>,
        Linus Torvalds <torvalds@linux-foundation.org>
Subject: Re: 6.1rc1: NFS memcpy warning on mount
Message-ID: <202210162144.76FBC7271@keescook>
References: <CAHk-=wj6y5fipM2A5kEuOO9qm5PBzUY=-m9viEahhtxT09KR_g@mail.gmail.com>
 <Y0zEzZwhOxTDcBTB@codemonkey.org.uk>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Y0zEzZwhOxTDcBTB@codemonkey.org.uk>
Precedence: bulk

On Sun, Oct 16, 2022 at 10:58:21PM -0400, Dave Jones wrote:
> [   19.617475] memcpy: detected field-spanning write (size 28) of single field "request.sap" at fs/nfs/super.c:857 (size 18446744073709551615)

I've sent this, which should fix it:
https://lore.kernel.org/lkml/20221017043107.never.457-kees@kernel.org/

However, the -1 size tells me something has gone slightly wrong with the
runtime warning, as it _should_ be ignoring destinations with "unknown"
size -- in this case, struct sockaddr has a trailing array, which is
treated (currently) as a fake flexible array, so __builtin_object_size()
is reporting the "-1". But with the coming -fstrict-flex-arrays, this
will need fixing anyway. I will re-check the runtime warning logic...

-- 
Kees Cook