lkml.org 
[lkml]   [2022]   [Oct]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 6.0 724/862] net: sched: cls_u32: Avoid memcpy() false-positive warning
    Date
    From: Kees Cook <keescook@chromium.org>

    [ Upstream commit 7cba18332e3635aaae60e4e7d4e52849de50d91b ]

    To work around a misbehavior of the compiler's ability to see into
    composite flexible array structs (as detailed in the coming memcpy()
    hardening series[1]), use unsafe_memcpy(), as the sizing,
    bounds-checking, and allocation are all very tightly coupled here.
    This silences the false-positive reported by syzbot:

    memcpy: detected field-spanning write (size 80) of single field "&n->sel" at net/sched/cls_u32.c:1043 (size 16)

    [1] https://lore.kernel.org/linux-hardening/20220901065914.1417829-2-keescook@chromium.org

    Cc: Cong Wang <xiyou.wangcong@gmail.com>
    Cc: Jiri Pirko <jiri@resnulli.us>
    Reported-by: syzbot+a2c4601efc75848ba321@syzkaller.appspotmail.com
    Link: https://lore.kernel.org/lkml/000000000000a96c0b05e97f0444@google.com/
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
    Link: https://lore.kernel.org/r/20220927153700.3071688-1-keescook@chromium.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/sched/cls_u32.c | 6 +++++-
    1 file changed, 5 insertions(+), 1 deletion(-)

    diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
    index 4d27300c287c..5f33472aad36 100644
    --- a/net/sched/cls_u32.c
    +++ b/net/sched/cls_u32.c
    @@ -1040,7 +1040,11 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
    }
    #endif

    - memcpy(&n->sel, s, sel_size);
    + unsafe_memcpy(&n->sel, s, sel_size,
    + /* A composite flex-array structure destination,
    + * which was correctly sized with struct_size(),
    + * bounds-checked against nla_len(), and allocated
    + * above. */);
    RCU_INIT_POINTER(n->ht_up, ht);
    n->handle = handle;
    n->fshift = s->hmask ? ffs(ntohl(s->hmask)) - 1 : 0;
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-10-19 13:12    [W:2.212 / U:0.656 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site