fs: Annotate struct file_handle with __counted_by() and use struct_size()

Prepare for the coming implementation by GCC and Clang of the __counted_by
attribute. Flexible array members annotated with __counted_by can have
their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for
array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family
functions).

While there, use struct_size() helper, instead of the open-coded
version.

[brauner@kernel.org: contains a fix by Edward for an OOB access]
Reported-by: syzbot+4139435cb1b34cf759c2@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Link: https://lore.kernel.org/r/tencent_A7845DD769577306D813742365E976E3A205@qq.com
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Link: https://lore.kernel.org/r/ZgImCXTdGDTeBvSS@neat
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>

diff --git a/fs/fhandle.c b/fs/fhandle.c
index 57a12614addfd434f981a5b8c981a48ae1a71ceb..8a7f86c2139a7fcd9a43b282c8408e046eaaa034 100644 (file)
--- a/fs/fhandle.c
+++ b/fs/fhandle.c
@@ -36,7 +36,7 @@ static long do_sys_name_to_handle(const struct path *path,
        if (f_handle.handle_bytes > MAX_HANDLE_SZ)
                return -EINVAL;
 
-       handle = kzalloc(sizeof(struct file_handle) + f_handle.handle_bytes,
+       handle = kzalloc(struct_size(handle, f_handle, f_handle.handle_bytes),
                         GFP_KERNEL);
        if (!handle)
                return -ENOMEM;
@@ -71,7 +71,7 @@ static long do_sys_name_to_handle(const struct path *path,
        /* copy the mount id */
        if (put_user(real_mount(path->mnt)->mnt_id, mnt_id) ||
            copy_to_user(ufh, handle,
-                        sizeof(struct file_handle) + handle_bytes))
+                        struct_size(handle, f_handle, handle_bytes)))
                retval = -EFAULT;
        kfree(handle);
        return retval;
@@ -192,7 +192,7 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
                retval = -EINVAL;
                goto out_err;
        }
-       handle = kmalloc(sizeof(struct file_handle) + f_handle.handle_bytes,
+       handle = kmalloc(struct_size(handle, f_handle, f_handle.handle_bytes),
                         GFP_KERNEL);
        if (!handle) {
                retval = -ENOMEM;

diff --git a/include/linux/fs.h b/include/linux/fs.h
index 00fc429b0af0fb9bbab2382a9e347fdbac383981..9142450855978b680d7619874ccffd7db8686fc3 100644 (file)
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1033,7 +1033,7 @@ struct file_handle {
        __u32 handle_bytes;
        int handle_type;
        /* file identifier */
-       unsigned char f_handle[];
+       unsigned char f_handle[] __counted_by(handle_bytes);
 };
 
 static inline struct file *get_file(struct file *f)