March 5, 2026 at 15:33, "Jiayuan Chen" <[email protected] mailto:[email protected]?to=%22Jiayuan%20Chen%22%20%3Cjiayuan.chen%40linux.dev%3E > wrote:
> > From: Jiayuan Chen <[email protected]> > > Syzbot reported a warning in u32_init_knode() [1]. > > Similar to commit 7cba18332e36 ("net: sched: cls_u32: Avoid memcpy() > false-positive warning") which addressed the same issue in u32_change(), > use unsafe_memcpy() in u32_init_knode() to work around the compiler's > inability to see into composite flexible array structs. > > This silences the false-positive reported by syzbot: > > memcpy: detected field-spanning write (size 32) of single field > "&new->sel" at net/sched/cls_u32.c:855 (size 16) > > Since the memory is correctly allocated with kzalloc_flex() using > s->nkeys, this is purely a false positive and does not need a Fixes tag. > > [1] https://syzkaller.appspot.com/bug?extid=d5ace703ed883df56e42 > > Reported-by: [email protected] > Closes: > https://lore.kernel.org/all/[email protected]/T/ > Signed-off-by: Jiayuan Chen <[email protected]> > Made-with: Cursor > --- > net/sched/cls_u32.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c > index 9241c025aa74..8f30cc82181d 100644 > --- a/net/sched/cls_u32.c > +++ b/net/sched/cls_u32.c > @@ -852,7 +852,10 @@ static struct tc_u_knode *u32_init_knode(struct net > *net, struct tcf_proto *tp, > /* Similarly success statistics must be moved as pointers */ > new->pcpu_success = n->pcpu_success; > #endif > - memcpy(&new->sel, s, struct_size(s, keys, s->nkeys)); > + unsafe_memcpy(&new->sel, s, struct_size(s, keys, s->nkeys), > + /* A composite flex-array structure destination, > + * which was correctly sized with kzalloc_flex(), > + * above. */); I'm thinking whether it's more appropriate: new->sel.hdr = s->hdr; memcpy(new->sel.keys, s->keys, flex_array_size(s, keys, s->nkeys)); > if (tcf_exts_init(&new->exts, net, TCA_U32_ACT, TCA_U32_POLICE)) { > kfree(new); > -- > 2.43.0 >
