]> git.ipfire.org Git - thirdparty/linux.git/commit
net: ipv6: fix field-spanning memcpy warning in AH output
authorCharalampos Mitrodimas <charmitro@posteo.net>
Tue, 12 Aug 2025 15:51:25 +0000 (15:51 +0000)
committerSteffen Klassert <steffen.klassert@secunet.com>
Fri, 15 Aug 2025 06:30:16 +0000 (08:30 +0200)
commit2327a3d6f65ce2fe2634546dde4a25ef52296fec
treed03c1a50396e86caf466137446c3faff31b09861
parent3b5ca25ecfa85098c7015251a0e7c78a8ff392e5
net: ipv6: fix field-spanning memcpy warning in AH output

Fix field-spanning memcpy warnings in ah6_output() and
ah6_output_done() where extension headers are copied to/from IPv6
address fields, triggering fortify-string warnings about writes beyond
the 16-byte address fields.

  memcpy: detected field-spanning write (size 40) of single field "&top_iph->saddr" at net/ipv6/ah6.c:439 (size 16)
  WARNING: CPU: 0 PID: 8838 at net/ipv6/ah6.c:439 ah6_output+0xe7e/0x14e0 net/ipv6/ah6.c:439

The warnings are false positives as the extension headers are
intentionally placed after the IPv6 header in memory. Fix by properly
copying addresses and extension headers separately, and introduce
helper functions to avoid code duplication.

Reported-by: syzbot+01b0667934cdceb4451c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=01b0667934cdceb4451c
Signed-off-by: Charalampos Mitrodimas <charmitro@posteo.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
net/ipv6/ah6.c