From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Jakub Kicinski <kuba@kernel.org>
Cc: joao@overdrivepizza.com, netfilter-devel@vger.kernel.org,
coreteam@netfilter.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org, kadlec@netfilter.org, fw@strlen.de,
davem@davemloft.net, edumazet@google.com, pabeni@redhat.com,
rkannoth@marvell.com, wojciech.drewek@intel.com,
steen.hegenlund@microhip.com, keescook@chromium.org,
Joao Moreira <joao.moreira@intel.com>
Subject: Re: [PATCH 0/2] Prevent potential write out of bounds
Date: Fri, 1 Sep 2023 10:15:06 +0200 [thread overview]
Message-ID: <ZPGdihJLKXOj7rDI@calendula> (raw)
In-Reply-To: <20230831182800.25e5d4d9@kernel.org>
On Thu, Aug 31, 2023 at 06:28:00PM -0700, Jakub Kicinski wrote:
> On Thu, 31 Aug 2023 18:04:35 -0700 joao@overdrivepizza.com wrote:
> > The function flow_rule_alloc in net/core/flow_offload.c [2] gets an
> > unsigned int num_actions (line 10) and later traverses the actions in
> > the rule (line 24) setting hw.stats to FLOW_ACTION_HW_STATS_DONT_CARE.
> >
> > Within the same file, the loop in the line 24 compares a signed int
> > (i) to an unsigned int (num_actions), and then uses i as an array
> > index. If an integer overflow happens, then the array within the loop
> > is wrongly indexed, causing a write out of bounds.
> >
> > After checking with maintainers, it seems that the front-end caps the
> > maximum value of num_action, thus it is not possible to reach the given
> > write out of bounds, yet, still, to prevent disasters it is better to
> > fix the signedness here.
>
> How did you find this? The commit messages should include info
> about how the issue was discovered.
This is net-next material IMO, none of the existing interfaces uses
such a large number of actions for this to be an issue.
prev parent reply other threads:[~2023-09-01 8:15 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-01 1:04 [PATCH 0/2] Prevent potential write out of bounds joao
2023-09-01 1:04 ` [PATCH 1/2] Make loop indexes unsigned joao
2023-09-01 1:04 ` [PATCH 2/2] Ensure num_actions is not a negative joao
2023-09-01 8:58 ` Pablo Neira Ayuso
2023-09-01 1:28 ` [PATCH 0/2] Prevent potential write out of bounds Jakub Kicinski
2023-09-01 5:46 ` Joao Moreira
2023-09-01 8:15 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZPGdihJLKXOj7rDI@calendula \
--to=pablo@netfilter.org \
--cc=coreteam@netfilter.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=fw@strlen.de \
--cc=joao.moreira@intel.com \
--cc=joao@overdrivepizza.com \
--cc=kadlec@netfilter.org \
--cc=keescook@chromium.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=rkannoth@marvell.com \
--cc=steen.hegenlund@microhip.com \
--cc=wojciech.drewek@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.