* [PATCH net v2] net/sched: flower: fix possible OOB write in fl_set_geneve_opt()
@ 2023-05-31 10:28 Hangyu Hua
2023-05-31 15:26 ` Simon Horman
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Hangyu Hua @ 2023-05-31 10:28 UTC (permalink / raw)
To: jhs, xiyou.wangcong, jiri, davem, edumazet, kuba, pabeni,
simon.horman, pieter.jansen-van-vuuren
Cc: netdev, linux-kernel, Hangyu Hua
If we send two TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets and their total
size is 252 bytes(key->enc_opts.len = 252) then
key->enc_opts.len = opt->length = data_len / 4 = 0 when the third
TCA_FLOWER_KEY_ENC_OPTS_GENEVE packet enters fl_set_geneve_opt. This
bypasses the next bounds check and results in an out-of-bounds.
Fixes: 0a6e77784f49 ("net/sched: allow flower to match tunnel options")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
---
v2: add "net" tag to title
net/sched/cls_flower.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 9dbc43388e57..815c3e416bc5 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -1153,6 +1153,9 @@ static int fl_set_geneve_opt(const struct nlattr *nla, struct fl_flow_key *key,
if (option_len > sizeof(struct geneve_opt))
data_len = option_len - sizeof(struct geneve_opt);
+ if (key->enc_opts.len > FLOW_DIS_TUN_OPTS_MAX - 4)
+ return -ERANGE;
+
opt = (struct geneve_opt *)&key->enc_opts.data[key->enc_opts.len];
memset(opt, 0xff, option_len);
opt->length = data_len / 4;
--
2.34.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH net v2] net/sched: flower: fix possible OOB write in fl_set_geneve_opt()
2023-05-31 10:28 [PATCH net v2] net/sched: flower: fix possible OOB write in fl_set_geneve_opt() Hangyu Hua
@ 2023-05-31 15:26 ` Simon Horman
2023-06-01 8:24 ` Pieter Jansen van Vuuren
2023-06-01 11:10 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: Simon Horman @ 2023-05-31 15:26 UTC (permalink / raw)
To: Hangyu Hua
Cc: jhs, xiyou.wangcong, jiri, davem, edumazet, kuba, pabeni,
pieter.jansen-van-vuuren, netdev, linux-kernel
On Wed, May 31, 2023 at 06:28:04PM +0800, Hangyu Hua wrote:
> If we send two TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets and their total
> size is 252 bytes(key->enc_opts.len = 252) then
> key->enc_opts.len = opt->length = data_len / 4 = 0 when the third
> TCA_FLOWER_KEY_ENC_OPTS_GENEVE packet enters fl_set_geneve_opt. This
> bypasses the next bounds check and results in an out-of-bounds.
>
> Fixes: 0a6e77784f49 ("net/sched: allow flower to match tunnel options")
> Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH net v2] net/sched: flower: fix possible OOB write in fl_set_geneve_opt()
2023-05-31 10:28 [PATCH net v2] net/sched: flower: fix possible OOB write in fl_set_geneve_opt() Hangyu Hua
2023-05-31 15:26 ` Simon Horman
@ 2023-06-01 8:24 ` Pieter Jansen van Vuuren
2023-06-01 11:10 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: Pieter Jansen van Vuuren @ 2023-06-01 8:24 UTC (permalink / raw)
To: Hangyu Hua, jhs, xiyou.wangcong, jiri, davem, edumazet, kuba,
pabeni, simon.horman
Cc: netdev, linux-kernel
On 31/05/2023 11:28, Hangyu Hua wrote:
> If we send two TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets and their total
> size is 252 bytes(key->enc_opts.len = 252) then
> key->enc_opts.len = opt->length = data_len / 4 = 0 when the third
> TCA_FLOWER_KEY_ENC_OPTS_GENEVE packet enters fl_set_geneve_opt. This
> bypasses the next bounds check and results in an out-of-bounds.
>
> Fixes: 0a6e77784f49 ("net/sched: allow flower to match tunnel options")
> Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Reviewed-by: Pieter Jansen van Vuuren <pieter.jansen-van-vuuren@amd.com>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH net v2] net/sched: flower: fix possible OOB write in fl_set_geneve_opt()
2023-05-31 10:28 [PATCH net v2] net/sched: flower: fix possible OOB write in fl_set_geneve_opt() Hangyu Hua
2023-05-31 15:26 ` Simon Horman
2023-06-01 8:24 ` Pieter Jansen van Vuuren
@ 2023-06-01 11:10 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: patchwork-bot+netdevbpf @ 2023-06-01 11:10 UTC (permalink / raw)
To: Hangyu Hua
Cc: jhs, xiyou.wangcong, jiri, davem, edumazet, kuba, pabeni,
simon.horman, pieter.jansen-van-vuuren, netdev, linux-kernel
Hello:
This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Wed, 31 May 2023 18:28:04 +0800 you wrote:
> If we send two TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets and their total
> size is 252 bytes(key->enc_opts.len = 252) then
> key->enc_opts.len = opt->length = data_len / 4 = 0 when the third
> TCA_FLOWER_KEY_ENC_OPTS_GENEVE packet enters fl_set_geneve_opt. This
> bypasses the next bounds check and results in an out-of-bounds.
>
> Fixes: 0a6e77784f49 ("net/sched: allow flower to match tunnel options")
> Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
>
> [...]
Here is the summary with links:
- [net,v2] net/sched: flower: fix possible OOB write in fl_set_geneve_opt()
https://git.kernel.org/netdev/net/c/4d56304e5827
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-06-01 11:10 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-05-31 10:28 [PATCH net v2] net/sched: flower: fix possible OOB write in fl_set_geneve_opt() Hangyu Hua
2023-05-31 15:26 ` Simon Horman
2023-06-01 8:24 ` Pieter Jansen van Vuuren
2023-06-01 11:10 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).