Skip to content

Commit

Permalink
net: sched: cls_u32: Avoid memcpy() false-positive warning
Browse files Browse the repository at this point in the history
To work around a misbehavior of the compiler's ability to see into
composite flexible array structs (as detailed in the coming memcpy()
hardening series[1]), use unsafe_memcpy(), as the sizing,
bounds-checking, and allocation are all very tightly coupled here.
This silences the false-positive reported by syzbot:

  memcpy: detected field-spanning write (size 80) of single field "&n->sel" at net/sched/cls_u32.c:1043 (size 16)

[1] https://lore.kernel.org/linux-hardening/[email protected]

Cc: Cong Wang <[email protected]>
Cc: Jiri Pirko <[email protected]>
Reported-by: [email protected]
Link: https://lore.kernel.org/lkml/[email protected]/
Signed-off-by: Kees Cook <[email protected]>
Reviewed-by: Jamal Hadi Salim <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
  • Loading branch information
kees authored and kuba-moo committed Sep 30, 2022
1 parent 5361660 commit 7cba183
Showing 1 changed file with 5 additions and 1 deletion.
6 changes: 5 additions & 1 deletion net/sched/cls_u32.c
Original file line number Diff line number Diff line change
Expand Up @@ -1040,7 +1040,11 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
}
#endif

memcpy(&n->sel, s, sel_size);
unsafe_memcpy(&n->sel, s, sel_size,
/* A composite flex-array structure destination,
* which was correctly sized with struct_size(),
* bounds-checked against nla_len(), and allocated
* above. */);
RCU_INIT_POINTER(n->ht_up, ht);
n->handle = handle;
n->fshift = s->hmask ? ffs(ntohl(s->hmask)) - 1 : 0;
Expand Down

0 comments on commit 7cba183

Please sign in to comment.