[v1] net: sched: cls_u32: Avoid memcpy() false-positive warning in u32_init_knode()

[PATCH net-next v1] net: sched: cls_u32: Avoid memcpy() false-positive warning in u32_init_knode()

Posted by Jiayuan Chen 1 month ago

From: Jiayuan Chen <jiayuan.chen@shopee.com>

Syzbot reported a warning in u32_init_knode() [1].

Similar to commit 7cba18332e36 ("net: sched: cls_u32: Avoid memcpy()
false-positive warning") which addressed the same issue in u32_change(),
use unsafe_memcpy() in u32_init_knode() to work around the compiler's
inability to see into composite flexible array structs.

This silences the false-positive reported by syzbot:

  memcpy: detected field-spanning write (size 32) of single field
  "&new->sel" at net/sched/cls_u32.c:855 (size 16)

Since the memory is correctly allocated with kzalloc_flex() using
s->nkeys, this is purely a false positive and does not need a Fixes tag.

[1] https://syzkaller.appspot.com/bug?extid=d5ace703ed883df56e42

Reported-by: syzbot+d5ace703ed883df56e42@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/69a811b9.a70a0220.b118c.0019.GAE@google.com/T/
Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Made-with: Cursor
---
 net/sched/cls_u32.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 9241c025aa74..8f30cc82181d 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -852,7 +852,10 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp,
 	/* Similarly success statistics must be moved as pointers */
 	new->pcpu_success = n->pcpu_success;
 #endif
-	memcpy(&new->sel, s, struct_size(s, keys, s->nkeys));
+	unsafe_memcpy(&new->sel, s, struct_size(s, keys, s->nkeys),
+		      /* A composite flex-array structure destination,
+		       * which was correctly sized with kzalloc_flex(),
+		       * above. */);
 
 	if (tcf_exts_init(&new->exts, net, TCA_U32_ACT, TCA_U32_POLICE)) {
 		kfree(new);
-- 
2.43.0

Re: [PATCH net-next v1] net: sched: cls_u32: Avoid memcpy() false-positive warning in u32_init_knode()

Posted by Simon Horman 1 month ago

On Thu, Mar 05, 2026 at 03:33:43PM +0800, Jiayuan Chen wrote:
> From: Jiayuan Chen <jiayuan.chen@shopee.com>
> 
> Syzbot reported a warning in u32_init_knode() [1].
> 
> Similar to commit 7cba18332e36 ("net: sched: cls_u32: Avoid memcpy()
> false-positive warning") which addressed the same issue in u32_change(),
> use unsafe_memcpy() in u32_init_knode() to work around the compiler's
> inability to see into composite flexible array structs.
> 
> This silences the false-positive reported by syzbot:
> 
>   memcpy: detected field-spanning write (size 32) of single field
>   "&new->sel" at net/sched/cls_u32.c:855 (size 16)
> 
> Since the memory is correctly allocated with kzalloc_flex() using
> s->nkeys, this is purely a false positive and does not need a Fixes tag.
> 
> [1] https://syzkaller.appspot.com/bug?extid=d5ace703ed883df56e42
> 
> Reported-by: syzbot+d5ace703ed883df56e42@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/69a811b9.a70a0220.b118c.0019.GAE@google.com/T/
> Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
> Made-with: Cursor

FWIIW, Made-with is a new tag to me, I would have expected Assisted-by.

That notwithstanding, this looks good to me.

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net-next v1] net: sched: cls_u32: Avoid memcpy() false-positive warning in u32_init_knode()

Posted by Gustavo A. R. Silva 1 month ago


On 3/5/26 16:33, Jiayuan Chen wrote:
> From: Jiayuan Chen <jiayuan.chen@shopee.com>
> 
> Syzbot reported a warning in u32_init_knode() [1].
> 
> Similar to commit 7cba18332e36 ("net: sched: cls_u32: Avoid memcpy()
> false-positive warning") which addressed the same issue in u32_change(),
> use unsafe_memcpy() in u32_init_knode() to work around the compiler's
> inability to see into composite flexible array structs.
> 
> This silences the false-positive reported by syzbot:
> 
>    memcpy: detected field-spanning write (size 32) of single field
>    "&new->sel" at net/sched/cls_u32.c:855 (size 16)
> 
> Since the memory is correctly allocated with kzalloc_flex() using
> s->nkeys, this is purely a false positive and does not need a Fixes tag.
> 
> [1] https://syzkaller.appspot.com/bug?extid=d5ace703ed883df56e42
> 
> Reported-by: syzbot+d5ace703ed883df56e42@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/69a811b9.a70a0220.b118c.0019.GAE@google.com/T/
> Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>

Acked-by: Gustavo A. R. Silva <gustavoars@kernel.org>

Thanks
-Gustavo

> Made-with: Cursor
> ---
>   net/sched/cls_u32.c | 5 ++++-
>   1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
> index 9241c025aa74..8f30cc82181d 100644
> --- a/net/sched/cls_u32.c
> +++ b/net/sched/cls_u32.c
> @@ -852,7 +852,10 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp,
>   	/* Similarly success statistics must be moved as pointers */
>   	new->pcpu_success = n->pcpu_success;
>   #endif
> -	memcpy(&new->sel, s, struct_size(s, keys, s->nkeys));
> +	unsafe_memcpy(&new->sel, s, struct_size(s, keys, s->nkeys),
> +		      /* A composite flex-array structure destination,
> +		       * which was correctly sized with kzalloc_flex(),
> +		       * above. */);
>   
>   	if (tcf_exts_init(&new->exts, net, TCA_U32_ACT, TCA_U32_POLICE)) {
>   		kfree(new);

Re: [PATCH net-next v1] net: sched: cls_u32: Avoid memcpy() false-positive warning in u32_init_knode()

Posted by Jiayuan Chen 1 month ago

March 5, 2026 at 15:33, "Jiayuan Chen" <jiayuan.chen@linux.dev mailto:jiayuan.chen@linux.dev?to=%22Jiayuan%20Chen%22%20%3Cjiayuan.chen%40linux.dev%3E > wrote:


> 
> From: Jiayuan Chen <jiayuan.chen@shopee.com>
> 
> Syzbot reported a warning in u32_init_knode() [1].
> 
> Similar to commit 7cba18332e36 ("net: sched: cls_u32: Avoid memcpy()
> false-positive warning") which addressed the same issue in u32_change(),
> use unsafe_memcpy() in u32_init_knode() to work around the compiler's
> inability to see into composite flexible array structs.
> 
> This silences the false-positive reported by syzbot:
> 
>  memcpy: detected field-spanning write (size 32) of single field
>  "&new->sel" at net/sched/cls_u32.c:855 (size 16)
> 
> Since the memory is correctly allocated with kzalloc_flex() using
> s->nkeys, this is purely a false positive and does not need a Fixes tag.
> 
> [1] https://syzkaller.appspot.com/bug?extid=d5ace703ed883df56e42
> 
> Reported-by: syzbot+d5ace703ed883df56e42@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/69a811b9.a70a0220.b118c.0019.GAE@google.com/T/
> Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
> Made-with: Cursor
> ---
>  net/sched/cls_u32.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
> index 9241c025aa74..8f30cc82181d 100644
> --- a/net/sched/cls_u32.c
> +++ b/net/sched/cls_u32.c
> @@ -852,7 +852,10 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp,
>  /* Similarly success statistics must be moved as pointers */
>  new->pcpu_success = n->pcpu_success;
>  #endif
> - memcpy(&new->sel, s, struct_size(s, keys, s->nkeys));
> + unsafe_memcpy(&new->sel, s, struct_size(s, keys, s->nkeys),
> + /* A composite flex-array structure destination,
> + * which was correctly sized with kzalloc_flex(),
> + * above. */);



I'm thinking whether it's more appropriate:

new->sel.hdr = s->hdr;
memcpy(new->sel.keys, s->keys, flex_array_size(s, keys, s->nkeys));

>  if (tcf_exts_init(&new->exts, net, TCA_U32_ACT, TCA_U32_POLICE)) {
>  kfree(new);
> -- 
> 2.43.0
>

Re: [PATCH net-next v1] net: sched: cls_u32: Avoid memcpy() false-positive warning in u32_init_knode()

Posted by Gustavo A. R. Silva 1 month ago


On 3/5/26 17:09, Jiayuan Chen wrote:
> March 5, 2026 at 15:33, "Jiayuan Chen" <jiayuan.chen@linux.dev mailto:jiayuan.chen@linux.dev?to=%22Jiayuan%20Chen%22%20%3Cjiayuan.chen%40linux.dev%3E > wrote:
> 
> 
>>
>> From: Jiayuan Chen <jiayuan.chen@shopee.com>
>>
>> Syzbot reported a warning in u32_init_knode() [1].
>>
>> Similar to commit 7cba18332e36 ("net: sched: cls_u32: Avoid memcpy()
>> false-positive warning") which addressed the same issue in u32_change(),
>> use unsafe_memcpy() in u32_init_knode() to work around the compiler's
>> inability to see into composite flexible array structs.
>>
>> This silences the false-positive reported by syzbot:
>>
>>   memcpy: detected field-spanning write (size 32) of single field
>>   "&new->sel" at net/sched/cls_u32.c:855 (size 16)
>>
>> Since the memory is correctly allocated with kzalloc_flex() using
>> s->nkeys, this is purely a false positive and does not need a Fixes tag.
>>
>> [1] https://syzkaller.appspot.com/bug?extid=d5ace703ed883df56e42
>>
>> Reported-by: syzbot+d5ace703ed883df56e42@syzkaller.appspotmail.com
>> Closes: https://lore.kernel.org/all/69a811b9.a70a0220.b118c.0019.GAE@google.com/T/
>> Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
>> Made-with: Cursor
>> ---
>>   net/sched/cls_u32.c | 5 ++++-
>>   1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
>> index 9241c025aa74..8f30cc82181d 100644
>> --- a/net/sched/cls_u32.c
>> +++ b/net/sched/cls_u32.c
>> @@ -852,7 +852,10 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp,
>>   /* Similarly success statistics must be moved as pointers */
>>   new->pcpu_success = n->pcpu_success;
>>   #endif
>> - memcpy(&new->sel, s, struct_size(s, keys, s->nkeys));
>> + unsafe_memcpy(&new->sel, s, struct_size(s, keys, s->nkeys),
>> + /* A composite flex-array structure destination,
>> + * which was correctly sized with kzalloc_flex(),
>> + * above. */);
> 
> 
> 
> I'm thinking whether it's more appropriate:
> 
> new->sel.hdr = s->hdr;
> memcpy(new->sel.keys, s->keys, flex_array_size(s, keys, s->nkeys));

I think unsafe_memcpy() is "better" in this case, as it will mark code
that could be updated/reviewed once the compiler can correctly see into
composite flexible structures in the future.

-Gustavo

> 
>>   if (tcf_exts_init(&new->exts, net, TCA_U32_ACT, TCA_U32_POLICE)) {
>>   kfree(new);
>> -- 
>> 2.43.0
>>
>