This is a note to let you know that I've just added the patch titled
net: sched: cls_u32: Avoid memcpy() false-positive warning
to the 6.0-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
net-sched-cls_u32-avoid-memcpy-false-positive-warnin.patch
and it can be found in the queue-6.0 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit 78e364994951b79cf3885138b757a073b135c9fe
Author: Kees Cook <keescook@xxxxxxxxxxxx>
Date: Tue Sep 27 08:37:01 2022 -0700
net: sched: cls_u32: Avoid memcpy() false-positive warning
[ Upstream commit 7cba18332e3635aaae60e4e7d4e52849de50d91b ]
To work around a misbehavior of the compiler's ability to see into
composite flexible array structs (as detailed in the coming memcpy()
hardening series[1]), use unsafe_memcpy(), as the sizing,
bounds-checking, and allocation are all very tightly coupled here.
This silences the false-positive reported by syzbot:
memcpy: detected field-spanning write (size 80) of single field "&n->sel" at net/sched/cls_u32.c:1043 (size 16)
[1] https://lore.kernel.org/linux-hardening/20220901065914.1417829-2-keescook@xxxxxxxxxxxx
Cc: Cong Wang <xiyou.wangcong@xxxxxxxxx>
Cc: Jiri Pirko <jiri@xxxxxxxxxxx>
Reported-by: syzbot+a2c4601efc75848ba321@xxxxxxxxxxxxxxxxxxxxxxxxx
Link: https://lore.kernel.org/lkml/000000000000a96c0b05e97f0444@xxxxxxxxxx/
Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
Reviewed-by: Jamal Hadi Salim <jhs@xxxxxxxxxxxx>
Link: https://lore.kernel.org/r/20220927153700.3071688-1-keescook@xxxxxxxxxxxx
Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 4d27300c287c..5f33472aad36 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -1040,7 +1040,11 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
}
#endif
- memcpy(&n->sel, s, sel_size);
+ unsafe_memcpy(&n->sel, s, sel_size,
+ /* A composite flex-array structure destination,
+ * which was correctly sized with struct_size(),
+ * bounds-checked against nla_len(), and allocated
+ * above. */);
RCU_INIT_POINTER(n->ht_up, ht);
n->handle = handle;
n->fshift = s->hmask ? ffs(ntohl(s->hmask)) - 1 : 0;
