From: Jiayuan Chen Date: Mon, 9 Mar 2026 12:39:16 +0000 (+0800) Subject: net: sched: cls_u32: Avoid memcpy() false-positive warning in u32_init_knode() X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=34bd3c6b0bd383a76d987c8c45c4f309b681b255;p=thirdparty%2Flinux.git net: sched: cls_u32: Avoid memcpy() false-positive warning in u32_init_knode() Syzbot reported a warning in u32_init_knode() [1]. Similar to commit 7cba18332e36 ("net: sched: cls_u32: Avoid memcpy() false-positive warning") which addressed the same issue in u32_change(), use unsafe_memcpy() in u32_init_knode() to work around the compiler's inability to see into composite flexible array structs. This silences the false-positive reported by syzbot: memcpy: detected field-spanning write (size 32) of single field "&new->sel" at net/sched/cls_u32.c:855 (size 16) Since the memory is correctly allocated with kzalloc_flex() using s->nkeys, this is purely a false positive and does not need a Fixes tag. [1] https://syzkaller.appspot.com/bug?extid=d5ace703ed883df56e42 Reported-by: syzbot+d5ace703ed883df56e42@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69a811b9.a70a0220.b118c.0019.GAE@google.com/T/ Reviewed-by: Simon Horman Acked-by: Gustavo A. R. Silva Signed-off-by: Jiayuan Chen Link: https://patch.msgid.link/20260309123917.402183-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski --- diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index 9241c025aa741..8f30cc82181d9 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -852,7 +852,10 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp, /* Similarly success statistics must be moved as pointers */ new->pcpu_success = n->pcpu_success; #endif - memcpy(&new->sel, s, struct_size(s, keys, s->nkeys)); + unsafe_memcpy(&new->sel, s, struct_size(s, keys, s->nkeys), + /* A composite flex-array structure destination, + * which was correctly sized with kzalloc_flex(), + * above. */); if (tcf_exts_init(&new->exts, net, TCA_U32_ACT, TCA_U32_POLICE)) { kfree(new);