Received-SPF: pass (google.com: domain of linux-kernel+bounces-23607-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
From: kovalev@altlinux.org
To: harshit.m.mogalapalli@oracle.com
Cc: arnd@arndb.de,
	bryantan@vmware.com,
	darren.kenny@oracle.com,
	error27@gmail.com,
	gregkh@linuxfoundation.org,
	gustavoars@kernel.org,
	keescook@chromium.org,
	linux-hardening@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	pv-drivers@vmware.com,
	syzkaller@googlegroups.com,
	vdasa@vmware.com,
	vegard.nossum@oracle.com,
	kovalev@altlinux.org,
	nickel@altlinux.org,
	oficerovas@altlinux.org,
	dutyrok@altlinux.org
Subject: Re: [PATCH v2 2/2] VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
Date: Thu, 11 Jan 2024 15:53:30 +0300
Message-Id: <20240111125330.53853-1-kovalev@altlinux.org>
In-Reply-To: <20240105164001.2129796-2-harshit.m.mogalapalli@oracle.com>
References: <20240105164001.2129796-2-harshit.m.mogalapalli@oracle.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Hello, I was also working on solving this problem
https://lore.kernel.org/lkml/20240110104042.31865-1-kovalev@altlinux.org/T/#t.

Please note that there are 2 such places in the code, and by analogy with your
version of the changes, including changes in the approach to calculating the
size of the allocated memory, additional changes on top of your changes will
be as follows:

diff --git a/drivers/misc/vmw_vmci/vmci_datagram.c b/drivers/misc/vmw_vmci/vmci_datagram.c
index ba379cd6d054bd..1a50fcea681bf8 100644
--- a/drivers/misc/vmw_vmci/vmci_datagram.c
+++ b/drivers/misc/vmw_vmci/vmci_datagram.c
@@ -369,8 +369,9 @@ int vmci_datagram_invoke_guest_handler(struct vmci_datagram *dg)
        if (dst_entry->run_delayed) {
                struct delayed_datagram_info *dg_info;
 
-               dg_info = kmalloc(sizeof(*dg_info) + (size_t)dg->payload_size,
+               dg_info = kmalloc(struct_size(dg_info, msg_payload, dg->payload_size),
                                  GFP_ATOMIC);
+
                if (!dg_info) {
                        vmci_resource_put(resource);
                        return VMCI_ERROR_NO_MEM;
@@ -378,7 +379,9 @@ int vmci_datagram_invoke_guest_handler(struct vmci_datagram *dg)
 
                dg_info->in_dg_host_queue = false;
                dg_info->entry = dst_entry;
-               memcpy(&dg_info->msg, dg, VMCI_DG_SIZE(dg));
+               dg_info->msg = *dg;
+               memcpy(&dg_info->msg_payload, dg + 1, dg->payload_size);
+
 
                INIT_WORK(&dg_info->work, dg_delayed_dispatch);
                schedule_work(&dg_info->work);