| Message ID | 20230808014821.241688-1-gongruiqi@huaweicloud.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | netfilter: ebtables: fix fortify warnings | expand |
Hi Ruiqi, kernel test robot noticed the following build errors: [auto build test ERROR on linus/master] [also build test ERROR on horms-ipvs/master v6.5-rc5 next-20230808] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/GONG-Ruiqi/netfilter-ebtables-fix-fortify-warnings/20230808-095125 base: linus/master patch link: https://lore.kernel.org/r/20230808014821.241688-1-gongruiqi%40huaweicloud.com patch subject: [PATCH] netfilter: ebtables: fix fortify warnings config: i386-randconfig-r011-20230808 (https://download.01.org/0day-ci/archive/20230808/202308081840.VN5BvVWf-lkp@intel.com/config) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce: (https://download.01.org/0day-ci/archive/20230808/202308081840.VN5BvVWf-lkp@intel.com/reproduce) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202308081840.VN5BvVWf-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from <command-line>: >> ./usr/include/linux/netfilter_bridge/ebtables.h:185:9: error: expected specifier-qualifier-list before 'struct_group' 185 | struct_group(offsets, | ^~~~~~~~~~~~ ./usr/include/linux/netfilter_bridge/ebtables.h: In function 'ebt_get_target': >> ./usr/include/linux/netfilter_bridge/ebtables.h:199:57: error: 'struct ebt_entry' has no member named 'target_offset' 199 | return (struct ebt_entry_target *)((char *)e + e->target_offset); | ^~
GONG, Ruiqi <gongruiqi@huaweicloud.com> wrote: > From: "GONG, Ruiqi" <gongruiqi1@huawei.com> > > When compiling with gcc 13 and CONFIG_FORTIFY_SOURCE=y, the following > warning appears: > > In function ‘fortify_memcpy_chk’, > inlined from ‘size_entry_mwt’ at net/bridge/netfilter/ebtables.c:2118:2: > ./include/linux/fortify-string.h:592:25: error: call to ‘__read_overflow2_field’ > declared with attribute warning: detected read beyond size of field (2nd parameter); > maybe use struct_group()? [-Werror=attribute-warning] > 592 | __read_overflow2_field(q_size_field, size); > | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > The compiler is complaining: > > memcpy(&offsets[1], &entry->watchers_offset, > sizeof(offsets) - sizeof(offsets[0])); > > where memcpy reads beyong &entry->watchers_offset to copy > {watchers,target,next}_offset altogether into offsets[]. Silence the > warning by wrapping these three up via struct_group(). > > Signed-off-by: GONG, Ruiqi <gongruiqi1@huawei.com> > --- > include/uapi/linux/netfilter_bridge/ebtables.h | 14 ++++++++------ > net/bridge/netfilter/ebtables.c | 3 +-- > 2 files changed, 9 insertions(+), 8 deletions(-) > > diff --git a/include/uapi/linux/netfilter_bridge/ebtables.h b/include/uapi/linux/netfilter_bridge/ebtables.h > index a494cf43a755..e634da196d08 100644 > --- a/include/uapi/linux/netfilter_bridge/ebtables.h > +++ b/include/uapi/linux/netfilter_bridge/ebtables.h > @@ -182,12 +182,14 @@ struct ebt_entry { > unsigned char sourcemsk[ETH_ALEN]; > unsigned char destmac[ETH_ALEN]; > unsigned char destmsk[ETH_ALEN]; > - /* sizeof ebt_entry + matches */ > - unsigned int watchers_offset; > - /* sizeof ebt_entry + matches + watchers */ > - unsigned int target_offset; > - /* sizeof ebt_entry + matches + watchers + target */ > - unsigned int next_offset; > + struct_group(offsets, > + /* sizeof ebt_entry + matches */ This is an UAPI header, I think you need to use __struct_group here.
On 2023/08/08 23:54, Florian Westphal wrote: > > [...] >> >> diff --git a/include/uapi/linux/netfilter_bridge/ebtables.h b/include/uapi/linux/netfilter_bridge/ebtables.h >> index a494cf43a755..e634da196d08 100644 >> --- a/include/uapi/linux/netfilter_bridge/ebtables.h >> +++ b/include/uapi/linux/netfilter_bridge/ebtables.h >> @@ -182,12 +182,14 @@ struct ebt_entry { >> unsigned char sourcemsk[ETH_ALEN]; >> unsigned char destmac[ETH_ALEN]; >> unsigned char destmsk[ETH_ALEN]; >> - /* sizeof ebt_entry + matches */ >> - unsigned int watchers_offset; >> - /* sizeof ebt_entry + matches + watchers */ >> - unsigned int target_offset; >> - /* sizeof ebt_entry + matches + watchers + target */ >> - unsigned int next_offset; >> + struct_group(offsets, >> + /* sizeof ebt_entry + matches */ > > This is an UAPI header, I think you need to use __struct_group here. Thanks for the reminder! I've fixed it in v2: https://lore.kernel.org/all/20230808133038.771316-1-gongruiqi@huaweicloud.com/ Please review it :)
diff --git a/include/uapi/linux/netfilter_bridge/ebtables.h b/include/uapi/linux/netfilter_bridge/ebtables.h index a494cf43a755..e634da196d08 100644 --- a/include/uapi/linux/netfilter_bridge/ebtables.h +++ b/include/uapi/linux/netfilter_bridge/ebtables.h @@ -182,12 +182,14 @@ struct ebt_entry { unsigned char sourcemsk[ETH_ALEN]; unsigned char destmac[ETH_ALEN]; unsigned char destmsk[ETH_ALEN]; - /* sizeof ebt_entry + matches */ - unsigned int watchers_offset; - /* sizeof ebt_entry + matches + watchers */ - unsigned int target_offset; - /* sizeof ebt_entry + matches + watchers + target */ - unsigned int next_offset; + struct_group(offsets, + /* sizeof ebt_entry + matches */ + unsigned int watchers_offset; + /* sizeof ebt_entry + matches + watchers */ + unsigned int target_offset; + /* sizeof ebt_entry + matches + watchers + target */ + unsigned int next_offset; + ); unsigned char elems[0] __attribute__ ((aligned (__alignof__(struct ebt_replace)))); }; diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c index 757ec46fc45a..5ec66b1ebb64 100644 --- a/net/bridge/netfilter/ebtables.c +++ b/net/bridge/netfilter/ebtables.c @@ -2115,8 +2115,7 @@ static int size_entry_mwt(const struct ebt_entry *entry, const unsigned char *ba return ret; offsets[0] = sizeof(struct ebt_entry); /* matches come first */ - memcpy(&offsets[1], &entry->watchers_offset, - sizeof(offsets) - sizeof(offsets[0])); + memcpy(&offsets[1], &entry->offsets, sizeof(offsets) - sizeof(offsets[0])); if (state->buf_kern_start) { buf_start = state->buf_kern_start + state->buf_kern_offset;