Received-SPF: pass (google.com: domain of linux-kernel+bounces-68178-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Message-ID: <3c2801be-acb6-4e6b-95e2-5bebe834c258@oracle.com>
Date: Fri, 16 Feb 2024 13:05:35 +0530
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH v2 2/2] VMCI: Fix memcpy() run-time warning in
 dg_dispatch_as_host()
Content-Language: en-US
To: kovalev@altlinux.org, keescook@chromium.org
Cc: arnd@arndb.de, bryantan@vmware.com, darren.kenny@oracle.com,
        error27@gmail.com, gregkh@linuxfoundation.org, gustavoars@kernel.org,
        linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org,
        pv-drivers@vmware.com, syzkaller@googlegroups.com, vdasa@vmware.com,
        vegard.nossum@oracle.com, nickel@altlinux.org, oficerovas@altlinux.org,
        dutyrok@altlinux.org
References: <20240105164001.2129796-2-harshit.m.mogalapalli@oracle.com>
 <20240111125330.53853-1-kovalev@altlinux.org>
From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
In-Reply-To: <20240111125330.53853-1-kovalev@altlinux.org>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?utf-8?B?TzZXMHlrZmp4S0lWNzN2dGpEKzhjd05iUTBZMjhsc0hKcjZGdWwrZ29RQVNj?=
 =?utf-8?B?b0FUbHJQSHR0QWwvVEhwOXpaalNjODh1OVAxeDI3M0dKbGgramNhREp0aTQ5?=
 =?utf-8?B?d2VTUUx0dzJKMG1ETFlyU0JGN2c5aUdmMFRNMDV6V1F3cENSMmFZcFZSVnFU?=
 =?utf-8?B?SDVmYWE4cUNvOUllSHdKRXlYUFRLTzFmN2RyOWlPRyt1VTZTcXdBNWhmSTdP?=
 =?utf-8?B?eWFJOERMN2pHYi9xcmlrRW1HTzVlYnh5MGYzandVL0lvd01hZXY1YjdQeisr?=
 =?utf-8?B?UzZORDJXaTJpeS81RDFpUGJYWDYxV0U1NkNQeXRFOG5PcXBBN0szNFUxSkVH?=
 =?utf-8?B?ZmdjZjFtT0RGUTBTOGhuS0xsMlgwRVJqU1lDdXZETEV1VGtHUkd2N05jcEZH?=
 =?utf-8?B?ZGFURkFmOUlLWWVNM0RxdkhSNnBmYmkzc0JKaURPVFFnR1g2aVhNcU0xS1Mw?=
 =?utf-8?B?anZQV213SzE1WW5RbTJMelZsNWlLcUJISFZ2SVhoQzduY3piN2VIK2Z0TnJQ?=
 =?utf-8?B?NUtMZVh6RmNYbEtvWW5XZSswUXVKRUpRVGlWckVOUzNHRm5zMEtlcCtRbjdT?=
 =?utf-8?B?TmF1SVBQMjhkUFpnQ094aWxvQ3NrSVRpNURVMWh5WEFEM2FKbkoxYjJnNGl1?=
 =?utf-8?B?VFBsYlhEWENtNFgvSE9LV0g5L1NpcnhjOHZ2QUlxMmdZU2FrNkdmV2ZMVDRl?=
 =?utf-8?B?Uk1YcW1qTWRrMitmd1drRlgyMktpMllzemZ3b0lqdUpjQUlhQzFiK3dsMlBv?=
 =?utf-8?B?bUJvby9zdWJobWtnOS9zUm5TK3BBejVJeUVSQURNZzZ5eXFmeGxRdERraFdq?=
 =?utf-8?B?NXZFZkhteHdPTjBCOFV6Z3YwN2JJbEEyQ1BISDNkSWVCL041R1RIcGNmbjY0?=
 =?utf-8?B?SDViZ1lkK3F6VWdzTzRuTmxwSXUyamZPTlZpNlBBUVhINk5WeDNQaXNqeHl3?=
 =?utf-8?B?eVp0SWFzVDBYQ1NaL2tCanlsTFpzYTdna3lZdkNYQUNRckhZdnh1WWI5dU1E?=
 =?utf-8?B?Tk01aXVvdVBmMUVENWJEdVovaXVVaWszRktTTXZTVFZKU29SWDRHMFFKOWQ3?=
 =?utf-8?B?dUtsSktNVTRhbDZHdzMvSTA4OE1mMnRlaXpuTVZoenVuMWs1dWU3SVpFNnVz?=
 =?utf-8?B?NW4yWTViMjNtRDg4ZXpDSUZUZCtpallMdldoNzFQaGJWcGdIZ3Axd0E0dkNB?=
 =?utf-8?B?V2hxQ3JiTTlPRVg3N2R2ajNiNnhnang3a3lIUVJDVXVLdmdyb2hpdS93UDk4?=
 =?utf-8?B?WGhtNEdQbDJMU1Y0NkhISFd1QUphUlVORy90d0NYNDBlSXIrQU5SdTBRMS9s?=
 =?utf-8?B?OXZXL0p2cW1WOWhvcHpvNStKUzNGeUJNZlphcWNFUGhRTDVEdmVaMEZMVkZz?=
 =?utf-8?B?L3N6bzUxQm81dXAvYXF6YjhPdjBkdFhaQkZGd2FsRnVQejVBWUsyYVNkS2xq?=
 =?utf-8?B?UEhtNUE3T2lPWTJtUXY0ZE1Ic1FSWDZ6bEc3QUgxY05GUXJNT01RMkdEU1Q2?=
 =?utf-8?B?SzFYQ2RkUTNlSmk4NzkvVGx5eFp6WjU1Tk4wY3BnRDNXU2hwdnBaeVgwUk5M?=
 =?utf-8?B?Q01RT2JZeFVBenlOOHZoNVVYRktOUmN4Qy9tajF2QkI2TjJEdjVZUlFyWmlp?=
 =?utf-8?B?V3k0bU1QUVF3Y3YwdndoMWVlQjZKaVp4Qkl3MFNmc3JlSHZnRzdPck1LMFRM?=
 =?utf-8?B?V0V6eXdJLytxQnRhNktrak8zL0xRU2YvcHovVG9oQk1zMktXdW1rNFltaEs5?=
 =?utf-8?B?T21TTmw2N3dHMVlwUCtKSUFMMzJCUzZRaDNQaEhDOHN4dzVOeUFwS0czVm5H?=
 =?utf-8?B?cG55cHJETWJxMEd4Q0g2RTlZUEpBQnNWa0o2WGtSWHVBRE5rRm9xQkJFL3Av?=
 =?utf-8?B?a3puallLOTRSR1ducTlMNjlTaHBuWUorbUd1bjlHM3ZRQmJGbUI1VnFCQzFD?=
 =?utf-8?B?aVNpSldiRm5aODd0SzdFUnpnNXVpM3NnY29MUnR6eFR5NGEyaTU1MytXcldj?=
 =?utf-8?B?U1FuMzBrTXkrbUtEekxTRnNVTjdqbGFIWXVWVmwrTWRxdkZ0YWFDcWtoV2NB?=
 =?utf-8?B?dHBWN3E5WEpvbW4wSU5TVzRJSmx4NnVaMm9pNWk0VXA3ZTc3b2JjOWVpMVZ0?=
 =?utf-8?B?TXpmbDZHYVkvZ0srbC8zWGxHZEtVVmh2TFhCaGFrWFRNUEM0MFBkY2JPT1po?=
 =?utf-8?Q?dyVLYulSZsh1vZoLZhAMdxo=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	A4CPR3jKmKKByBZGlmsp0gj+nh0VAdJkzy/fKy7lpox6YJeOdcUSGQTpjw0zpXzPAOYoq7NUIcHevoCg9PD16VDf/LTMO4+PyBbk2q37lFjyUSDtmPooG15/Xa6ulBSzjYh5sOpBIBtT8HNnefDGygazegWDjMuQKlssiH7BZeZz353sbH6vuuhK/FtJjKGrkvm7zNh3IEjawSPM6KnFg8QY/zVdKXaJF+Fb7DNOLBCYCuh0w2aBW+Zhq51SDF+KHgoMNaZAei4GKrV2GIlRVQkIDk7MWXo8ttuTta584ucM0hcTJTZGWR0qYTuIYcOr+LxfXAHfqBo9+ps6PHti8aWksRsziiAz+zVk2mzZQAW83bHlUUJUKPcp2P/mgwS25bedCOdqJ19z8g3HNDNvBi/Njdy1cxsz4xinp1148CPNI8S3eepQHTymK4qKx43gNDtXeI1u6s5Ucs02+qmK63Ci6CWZcgPPmwTjt0C1GdwwVoMKYFNBFAdHfmAyuYVPKezrGllfYIZIu3RmKjo24zqdyLbRaLDdoWqpmcb2TKf6N/wwReYOsSUXZIHJAsdbkmhuEqYdZIFBfTgOqk849DMrBOnYzLC/fGycarg+7VA=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c67e649c-51f4-4b2b-faf3-08dc2ec1e248
X-MS-Exchange-CrossTenant-AuthSource: PH8PR10MB6290.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Feb 2024 07:35:44.3528
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: o6kHaRmDk99th4LW+lja7TRPNbW8HQwpD9l1OZN3dYX2mKcWnKYbQxB/HaE7cMv6dHMEAMfhrb32e8+iJLdlr0C/9ffuQI0u/mpnBVvdc2jIl46tttKUzyMujLuGJP4i
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLAPR10MB5043
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2024-02-16_06,2024-02-14_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 mlxscore=0 spamscore=0
 adultscore=0 phishscore=0 bulkscore=0 mlxlogscore=999 suspectscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000
 definitions=main-2402160060
X-Proofpoint-ORIG-GUID: 2Ayf1Y0DbW_yNO7KYGgAtocN_mskjr8G
X-Proofpoint-GUID: 2Ayf1Y0DbW_yNO7KYGgAtocN_mskjr8G

Hi Kovalev,

On 11/01/24 6:23 pm, kovalev@altlinux.org wrote:
> Hello, I was also working on solving this problem
> https://lore.kernel.org/lkml/20240110104042.31865-1-kovalev@altlinux.org/T/#t.
> 
> Please note that there are 2 such places in the code, and by analogy with your
> version of the changes, including changes in the approach to calculating the
> size of the allocated memory, additional changes on top of your changes will
> be as follows:
> 
> diff --git a/drivers/misc/vmw_vmci/vmci_datagram.c b/drivers/misc/vmw_vmci/vmci_datagram.c
> index ba379cd6d054bd..1a50fcea681bf8 100644
> --- a/drivers/misc/vmw_vmci/vmci_datagram.c
> +++ b/drivers/misc/vmw_vmci/vmci_datagram.c
> @@ -369,8 +369,9 @@ int vmci_datagram_invoke_guest_handler(struct vmci_datagram *dg)
>          if (dst_entry->run_delayed) {
>                  struct delayed_datagram_info *dg_info;
>   
> -               dg_info = kmalloc(sizeof(*dg_info) + (size_t)dg->payload_size,
> +               dg_info = kmalloc(struct_size(dg_info, msg_payload, dg->payload_size),
>                                    GFP_ATOMIC);
> +
>                  if (!dg_info) {
>                          vmci_resource_put(resource);
>                          return VMCI_ERROR_NO_MEM;
> @@ -378,7 +379,9 @@ int vmci_datagram_invoke_guest_handler(struct vmci_datagram *dg)
>   
>                  dg_info->in_dg_host_queue = false;
>                  dg_info->entry = dst_entry;
> -               memcpy(&dg_info->msg, dg, VMCI_DG_SIZE(dg));
> +               dg_info->msg = *dg;
> +               memcpy(&dg_info->msg_payload, dg + 1, dg->payload_size);
> +
>   
>                  INIT_WORK(&dg_info->work, dg_delayed_dispatch);
>                  schedule_work(&dg_info->work);
I think you need to send a separate patch/patches for this.

[linux-next]$ git describe
next-20240216
[linux-next]$ git log --oneline drivers/misc/vmw_vmci/vmci_datagram.c
19b070fefd0d VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
e03d4910e6e4 VMCI: Use struct_size() in kmalloc()

I see that the two patches I sent are applied by Kees and are in linux-next.

I am thinking if we can reproduce the above WARNING in 
vmci_datagram_invoke_guest_handler() by modifying the C reproducer 
generated by Syzkaller for dg_dispatch_as_host()

Thanks,
Harshit