Re: [PATCH net] net/mlx5e: IPsec, Fix out-of-bounds comparison of neighbour keys

[sashiko-bot@kernel.org]

> From: Gal Pressman <gal@nvidia.com>
> 
> mlx5e_ipsec_netevent_event() keeps the L2 headers of offloaded tunnel
> mode SAs up to date: on every neighbour change it looks for SAs whose
> endpoint matches the neighbour's address. The compare width, 4 bytes for
> IPv4 or 16 for IPv6, is chosen from the SA's address family, with no
> check that the neighbour is of the same family.
> 
> An ARP entry only stores a 4-byte key, so with an IPv6 tunnel mode SA
> offloaded, any IPv4 neighbour update in the system is compared as if it
> were a 16-byte IPv6 address, reading past the end of the object:
> 
>   BUG: KASAN: slab-out-of-bounds in mlx5e_ipsec_netevent_event+0x736/0x8d0 [mlx5_core]
>   Read of size 4 at addr ff110001260a4ad8 by task swapper/8/0
>   Call Trace:
> [ ... ]
> Fixes: 4c24272b4e2b ("net/mlx5e: Listen to ARP events to update IPsec L2 headers in tunnel mode")
> Signed-off-by: Gal Pressman <gal@nvidia.com>
> Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
> Reviewed-by: Yael Chemla <ychemla@nvidia.com>
> Signed-off-by: Tariq Toukan <tariqt@nvidia.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261021064231.3466989-1-tariqt@nvidia.com?part=1