Skip to content

Commit 7cba183

Browse files
keeskuba-moo
authored andcommitted
net: sched: cls_u32: Avoid memcpy() false-positive warning
To work around a misbehavior of the compiler's ability to see into composite flexible array structs (as detailed in the coming memcpy() hardening series[1]), use unsafe_memcpy(), as the sizing, bounds-checking, and allocation are all very tightly coupled here. This silences the false-positive reported by syzbot: memcpy: detected field-spanning write (size 80) of single field "&n->sel" at net/sched/cls_u32.c:1043 (size 16) [1] https://lore.kernel.org/linux-hardening/[email protected] Cc: Cong Wang <[email protected]> Cc: Jiri Pirko <[email protected]> Reported-by: [email protected] Link: https://lore.kernel.org/lkml/[email protected]/ Signed-off-by: Kees Cook <[email protected]> Reviewed-by: Jamal Hadi Salim <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jakub Kicinski <[email protected]>
1 parent 5361660 commit 7cba183

File tree

1 file changed

+5
-1
lines changed

1 file changed

+5
-1
lines changed

net/sched/cls_u32.c

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1040,7 +1040,11 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
10401040
}
10411041
#endif
10421042

1043-
memcpy(&n->sel, s, sel_size);
1043+
unsafe_memcpy(&n->sel, s, sel_size,
1044+
/* A composite flex-array structure destination,
1045+
* which was correctly sized with struct_size(),
1046+
* bounds-checked against nla_len(), and allocated
1047+
* above. */);
10441048
RCU_INIT_POINTER(n->ht_up, ht);
10451049
n->handle = handle;
10461050
n->fshift = s->hmask ? ffs(ntohl(s->hmask)) - 1 : 0;

0 commit comments

Comments
 (0)