| Message ID | 20220927153700.3071688-1-keescook@chromium.org (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | 7cba18332e3635aaae60e4e7d4e52849de50d91b |
| Headers | show |
| Series | net: sched: cls_u32: Avoid memcpy() false-positive warning | expand |
On Tue, Sep 27, 2022 at 11:37 AM Kees Cook <keescook@chromium.org> wrote: > > To work around a misbehavior of the compiler's ability to see into > composite flexible array structs (as detailed in the coming memcpy() > hardening series[1]), use unsafe_memcpy(), as the sizing, > bounds-checking, and allocation are all very tightly coupled here. > This silences the false-positive reported by syzbot: > > memcpy: detected field-spanning write (size 80) of single field "&n->sel" at net/sched/cls_u32.c:1043 (size 16) > > [1] https://lore.kernel.org/linux-hardening/20220901065914.1417829-2-keescook@chromium.org > > Cc: Jamal Hadi Salim <jhs@mojatatu.com> > Cc: Eric Dumazet <edumazet@google.com> > Cc: Cong Wang <xiyou.wangcong@gmail.com> > Cc: Jiri Pirko <jiri@resnulli.us> > Cc: "David S. Miller" <davem@davemloft.net> > Cc: Jakub Kicinski <kuba@kernel.org> > Cc: Paolo Abeni <pabeni@redhat.com> > Cc: netdev@vger.kernel.org > Reported-by: syzbot+a2c4601efc75848ba321@syzkaller.appspotmail.com > Link: https://lore.kernel.org/lkml/000000000000a96c0b05e97f0444@google.com/ > Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com> cheers, jamal
Hello: This patch was applied to netdev/net-next.git (master) by Jakub Kicinski <kuba@kernel.org>: On Tue, 27 Sep 2022 08:37:01 -0700 you wrote: > To work around a misbehavior of the compiler's ability to see into > composite flexible array structs (as detailed in the coming memcpy() > hardening series[1]), use unsafe_memcpy(), as the sizing, > bounds-checking, and allocation are all very tightly coupled here. > This silences the false-positive reported by syzbot: > > memcpy: detected field-spanning write (size 80) of single field "&n->sel" at net/sched/cls_u32.c:1043 (size 16) > > [...] Here is the summary with links: - net: sched: cls_u32: Avoid memcpy() false-positive warning https://git.kernel.org/netdev/net-next/c/7cba18332e36 You are awesome, thank you!
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index 4d27300c287c..5f33472aad36 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -1040,7 +1040,11 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, } #endif - memcpy(&n->sel, s, sel_size); + unsafe_memcpy(&n->sel, s, sel_size, + /* A composite flex-array structure destination, + * which was correctly sized with struct_size(), + * bounds-checked against nla_len(), and allocated + * above. */); RCU_INIT_POINTER(n->ht_up, ht); n->handle = handle; n->fshift = s->hmask ? ffs(ntohl(s->hmask)) - 1 : 0;
To work around a misbehavior of the compiler's ability to see into composite flexible array structs (as detailed in the coming memcpy() hardening series[1]), use unsafe_memcpy(), as the sizing, bounds-checking, and allocation are all very tightly coupled here. This silences the false-positive reported by syzbot: memcpy: detected field-spanning write (size 80) of single field "&n->sel" at net/sched/cls_u32.c:1043 (size 16) [1] https://lore.kernel.org/linux-hardening/20220901065914.1417829-2-keescook@chromium.org Cc: Jamal Hadi Salim <jhs@mojatatu.com> Cc: Eric Dumazet <edumazet@google.com> Cc: Cong Wang <xiyou.wangcong@gmail.com> Cc: Jiri Pirko <jiri@resnulli.us> Cc: "David S. Miller" <davem@davemloft.net> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: netdev@vger.kernel.org Reported-by: syzbot+a2c4601efc75848ba321@syzkaller.appspotmail.com Link: https://lore.kernel.org/lkml/000000000000a96c0b05e97f0444@google.com/ Signed-off-by: Kees Cook <keescook@chromium.org> --- net/sched/cls_u32.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)