Re: [syzbot] WARNING in u32_change
From: Dan Carpenter <hidden>
Date: 2022-09-26 10:31:34
Also in:
lkml
On Sun, Sep 25, 2022 at 12:14:44PM -0400, Jamal Hadi Salim wrote:
quoted hunk ↗ jump to hunk
On Sun, Sep 25, 2022 at 11:38 AM Jamal Hadi Salim [off-list ref] wrote:quoted
Is there a way to tell the boat "looking into it?"I guess I have to swim across to it to get the message;-> I couldnt see the warning message but it is obvious by inspection that the memcpy is broken. We should add more test coverage. This should fix it. Will send a formal patch later:diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index 4d27300c2..591cbbf27 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c@@ -1019,7 +1019,7 @@ static int u32_change(struct net *net, structsk_buff *in_skb, } s = nla_data(tb[TCA_U32_SEL]); - sel_size = struct_size(s, keys, s->nkeys); + sel_size = struct_size(s, keys, s->nkeys) + sizeof(n->sel);
Smatch will soon start complaining about these. Can we instead do: sel_size = size_add(struct_size(s, keys, s->nkeys), sizeof(n->sel)); Probably eventually Smatch will be able to detect some times when struct_size() is used for readability and not for safety so maybe it won't warn... regards, dan carpenter