From: Jiayuan Chen <[email protected]>
Syzbot reported a warning in u32_init_knode() [1].
Similar to commit 7cba18332e36 ("net: sched: cls_u32: Avoid memcpy()
false-positive warning") which addressed the same issue in u32_change(),
use unsafe_memcpy() in u32_init_knode() to work around the compiler's
inability to see into composite flexible array structs.
This silences the false-positive reported by syzbot:
memcpy: detected field-spanning write (size 32) of single field
"&new->sel" at net/sched/cls_u32.c:855 (size 16)
Since the memory is correctly allocated with kzalloc_flex() using
s->nkeys, this is purely a false positive and does not need a Fixes tag.
[1] https://syzkaller.appspot.com/bug?extid=d5ace703ed883df56e42
Reported-by: [email protected]
Closes:
https://lore.kernel.org/all/[email protected]/T/
Signed-off-by: Jiayuan Chen <[email protected]>
Made-with: Cursor
---
net/sched/cls_u32.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 9241c025aa74..8f30cc82181d 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -852,7 +852,10 @@ static struct tc_u_knode *u32_init_knode(struct net *net,
struct tcf_proto *tp,
/* Similarly success statistics must be moved as pointers */
new->pcpu_success = n->pcpu_success;
#endif
- memcpy(&new->sel, s, struct_size(s, keys, s->nkeys));
+ unsafe_memcpy(&new->sel, s, struct_size(s, keys, s->nkeys),
+ /* A composite flex-array structure destination,
+ * which was correctly sized with kzalloc_flex(),
+ * above. */);
if (tcf_exts_init(&new->exts, net, TCA_U32_ACT, TCA_U32_POLICE)) {
kfree(new);
--
2.43.0
