wireguard: netlink: avoid variable-sized memcpy on sockaddr

[ Upstream commit 26c013108c12b94bc023bf19198a4300596c98b1 ]

Doing a variable-sized memcpy is slower, and the compiler isn't smart
enough to turn this into a constant-size assignment.

Further, Kees' latest fortified memcpy will actually bark, because the
destination pointer is type sockaddr, not explicitly sockaddr_in or
sockaddr_in6, so it thinks there's an overflow:

    memcpy: detected field-spanning write (size 28) of single field
    "&endpoint.addr" at drivers/net/wireguard/netlink.c:446 (size 16)

Fix this by just assigning by using explicit casts for each checked
case.

Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reported-by: syzbot+a448cda4dba2dac50de5@syzkaller.appspotmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/wireguard/netlink.c b/drivers/net/wireguard/netlink.c
index d0f3b6d7f40894fdee515c471295d3516da9b13d..5c804bcabfe6be5b87e015b633aaeff57885cb84 100644 (file)
--- a/drivers/net/wireguard/netlink.c
+++ b/drivers/net/wireguard/netlink.c
@@ -436,14 +436,13 @@ static int set_peer(struct wg_device *wg, struct nlattr **attrs)
        if (attrs[WGPEER_A_ENDPOINT]) {
                struct sockaddr *addr = nla_data(attrs[WGPEER_A_ENDPOINT]);
                size_t len = nla_len(attrs[WGPEER_A_ENDPOINT]);
+               struct endpoint endpoint = { { { 0 } } };
 
-               if ((len == sizeof(struct sockaddr_in) &&
-                    addr->sa_family == AF_INET) ||
-                   (len == sizeof(struct sockaddr_in6) &&
-                    addr->sa_family == AF_INET6)) {
-                       struct endpoint endpoint = { { { 0 } } };
-
-                       memcpy(&endpoint.addr, addr, len);
+               if (len == sizeof(struct sockaddr_in) && addr->sa_family == AF_INET) {
+                       endpoint.addr4 = *(struct sockaddr_in *)addr;
+                       wg_socket_set_peer_endpoint(peer, &endpoint);
+               } else if (len == sizeof(struct sockaddr_in6) && addr->sa_family == AF_INET6) {
+                       endpoint.addr6 = *(struct sockaddr_in6 *)addr;
                        wg_socket_set_peer_endpoint(peer, &endpoint);
                }
        }