system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-07-21 02:23:16 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fs: Annotate struct file_handle with __counted_by() and use struct_size()

Browse source 
Prepare for the coming implementation by GCC and Clang of the __counted_by
attribute. Flexible array members annotated with __counted_by can have
their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for
array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family
functions).

While there, use struct_size() helper, instead of the open-coded
version.

[brauner@kernel.org: contains a fix by Edward for an OOB access]
Reported-by: syzbot+4139435cb1b34cf759c2@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Link: https://lore.kernel.org/r/tencent_A7845DD769577306D813742365E976E3A205@qq.com
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Link: https://lore.kernel.org/r/ZgImCXTdGDTeBvSS@neat
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
This commit is contained in:
Gustavo A. R. Silva 2024-03-25 19:34:01 -06:00 committed by Christian Brauner
parent 61db088eeb
commit 68d6f4f3fb
No known key found for this signature in database
GPG key ID: 91C61BC06578DCA2
2 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
fs/fhandle.c
View file

@ -36,7 +36,7 @@ static long do_sys_name_to_handle(const struct path *path,
if (f_handle.handle_bytes > MAX_HANDLE_SZ) if (f_handle.handle_bytes > MAX_HANDLE_SZ)
return -EINVAL; return -EINVAL;
handle = kzalloc(sizeof(struct file_handle) + f_handle.handle_bytes, handle = kzalloc(struct_size(handle, f_handle, f_handle.handle_bytes),
GFP_KERNEL); GFP_KERNEL);
if (!handle) if (!handle)
return -ENOMEM; return -ENOMEM;
@ -71,7 +71,7 @@ static long do_sys_name_to_handle(const struct path *path,
/* copy the mount id */ /* copy the mount id */
if (put_user(real_mount(path->mnt)->mnt_id, mnt_id) || if (put_user(real_mount(path->mnt)->mnt_id, mnt_id) ||
copy_to_user(ufh, handle, copy_to_user(ufh, handle,
sizeof(struct file_handle) + handle_bytes)) struct_size(handle, f_handle, handle_bytes)))
retval = -EFAULT; retval = -EFAULT;
kfree(handle); kfree(handle);
return retval; return retval;
@ -192,7 +192,7 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
retval = -EINVAL; retval = -EINVAL;
goto out_err; goto out_err;
} }
handle = kmalloc(sizeof(struct file_handle) + f_handle.handle_bytes, handle = kmalloc(struct_size(handle, f_handle, f_handle.handle_bytes),
GFP_KERNEL); GFP_KERNEL);
if (!handle) { if (!handle) {
retval = -ENOMEM; retval = -ENOMEM;

2
include/linux/fs.h
View file

@ -1033,7 +1033,7 @@ struct file_handle {
__u32 handle_bytes; __u32 handle_bytes;
int handle_type; int handle_type;
/* file identifier */ /* file identifier */
unsigned char f_handle[]; unsigned char f_handle[] __counted_by(handle_bytes);
}; };
static inline struct file *get_file(struct file *f) static inline struct file *get_file(struct file *f)