Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <bd11473cd4e2a92c4ce2a32d370800522862ad4b.camel@redhat.com>
Subject: Re: [PATCH][next] net: dev: Convert sa_data to flexible array in
 struct sockaddr
From:   Paolo Abeni <pabeni@redhat.com>
To:     Kees Cook <keescook@chromium.org>, Jakub Kicinski <kuba@kernel.org>
Cc:     "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Jens Axboe <axboe@kernel.dk>,
        Pavel Begunkov <asml.silence@gmail.com>,
        David Ahern <dsahern@kernel.org>,
        Dylan Yudaken <dylany@fb.com>,
        Yajun Deng <yajun.deng@linux.dev>,
        Petr Machata <petrm@nvidia.com>,
        Hangbin Liu <liuhangbin@gmail.com>,
        Leon Romanovsky <leon@kernel.org>,
        syzbot <syzkaller@googlegroups.com>,
        Willem de Bruijn <willemb@google.com>,
        Pablo Neira Ayuso <pablo@netfilter.org>,
        netdev@vger.kernel.org, Nathan Chancellor <nathan@kernel.org>,
        Nick Desaulniers <ndesaulniers@google.com>,
        Tom Rix <trix@redhat.com>,
        "D. Wythe" <alibuda@linux.alibaba.com>,
        Jeremy Kerr <jk@codeconstruct.com.au>,
        Sebastian Andrzej Siewior <bigeasy@linutronix.de>,
        Menglong Dong <imagedong@tencent.com>,
        Kuniyuki Iwashima <kuniyu@amazon.com>,
        Congyu Liu <liu3101@purdue.edu>,
        Wolfram Sang <wsa+renesas@sang-engineering.com>,
        Ziyang Xuan <william.xuanziyang@huawei.com>,
        linux-kernel@vger.kernel.org, llvm@lists.linux.dev,
        linux-hardening@vger.kernel.org
Date:   Thu, 20 Oct 2022 10:58:50 +0200
In-Reply-To: <20221018095503.never.671-kees@kernel.org>
References: <20221018095503.never.671-kees@kernel.org>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.42.4 (3.42.4-2.fc35) 
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Precedence: bulk

Hello,

On Tue, 2022-10-18 at 02:56 -0700, Kees Cook wrote:
> One of the worst offenders of "fake flexible arrays" is struct sockaddr,
> as it is the classic example of why GCC and Clang have been traditionally
> forced to treat all trailing arrays as fake flexible arrays: in the
> distant misty past, sa_data became too small, and code started just
> treating it as a flexible array, even though it was fixed-size. The
> special case by the compiler is specifically that sizeof(sa->sa_data)
> and FORTIFY_SOURCE (which uses __builtin_object_size(sa->sa_data, 1))
> do not agree (14 and -1 respectively), which makes FORTIFY_SOURCE treat
> it as a flexible array.
> 
> However, the coming -fstrict-flex-arrays compiler flag will remove
> these special cases so that FORTIFY_SOURCE can gain coverage over all
> the trailing arrays in the kernel that are _not_ supposed to be treated
> as a flexible array. To deal with this change, convert sa_data to a true
> flexible array. To keep the structure size the same, move sa_data into
> a union with a newly introduced sa_data_min with the original size. The
> result is that FORTIFY_SOURCE can continue to have no idea how large
> sa_data may actually be, but anything using sizeof(sa->sa_data) must
> switch to sizeof(sa->sa_data_min).
> 
> Cc: Jakub Kicinski <kuba@kernel.org>
> Cc: "David S. Miller" <davem@davemloft.net>
> Cc: Eric Dumazet <edumazet@google.com>
> Cc: Paolo Abeni <pabeni@redhat.com>
> Cc: Jens Axboe <axboe@kernel.dk>
> Cc: Pavel Begunkov <asml.silence@gmail.com>
> Cc: David Ahern <dsahern@kernel.org>
> Cc: Dylan Yudaken <dylany@fb.com>
> Cc: Yajun Deng <yajun.deng@linux.dev>
> Cc: Petr Machata <petrm@nvidia.com>
> Cc: Hangbin Liu <liuhangbin@gmail.com>
> Cc: Leon Romanovsky <leon@kernel.org>
> Cc: syzbot <syzkaller@googlegroups.com>
> Cc: Willem de Bruijn <willemb@google.com>
> Cc: Pablo Neira Ayuso <pablo@netfilter.org>
> Cc: netdev@vger.kernel.org
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
>  include/linux/socket.h |  5 ++++-
>  net/core/dev.c         |  2 +-
>  net/core/dev_ioctl.c   |  2 +-
>  net/packet/af_packet.c | 10 +++++-----
>  4 files changed, 11 insertions(+), 8 deletions(-)
> 
> diff --git a/include/linux/socket.h b/include/linux/socket.h
> index de3701a2a212..13c3a237b9c9 100644
> --- a/include/linux/socket.h
> +++ b/include/linux/socket.h
> @@ -33,7 +33,10 @@ typedef __kernel_sa_family_t	sa_family_t;
>  
>  struct sockaddr {
>  	sa_family_t	sa_family;	/* address family, AF_xxx	*/
> -	char		sa_data[14];	/* 14 bytes of protocol address	*/
> +	union {
> +		char sa_data_min[14];		/* Minimum 14 bytes of protocol address	*/
> +		DECLARE_FLEX_ARRAY(char, sa_data);

Any special reason to avoid preserving the old name for the array and
e.g. using sa_data_flex for the new field, so we don't have to touch
the sockaddr users?

Thanks!

Paolo