[PATCH net] net: openvswitch: ensure LSE is pullable before reading it

[PATCH net] net: openvswitch: ensure LSE is pullable before reading it

[Davide Caratti]

when openvswitch is configured to mangle the LSE, the current value is
read from the packet dereferencing 4 bytes at mpls_hdr(): ensure that
the label is contained in the skb "linear" area.

Found by code inspection.

Fixes: d27cf5c59a12 ("net: core: add MPLS update core helper and use in OvS")
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
---
 net/openvswitch/actions.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index 5829a020b81c..c3a664871cb5 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -199,6 +199,9 @@ static int set_mpls(struct sk_buff *skb, struct sw_flow_key *flow_key,
 	__be32 lse;
 	int err;
 
+	if (!pskb_may_pull(skb, skb_network_offset(skb) + MPLS_HLEN))
+		return -ENOMEM;
+
 	stack = mpls_hdr(skb);
 	lse = OVS_MASKED(stack->label_stack_entry, *mpls_lse, *mask);
 	err = skb_mpls_update_lse(skb, lse);
-- 
2.28.0

Re: [PATCH net] net: openvswitch: ensure LSE is pullable before reading it

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (refs/heads/master):

On Thu,  3 Dec 2020 10:46:06 +0100 you wrote:
> when openvswitch is configured to mangle the LSE, the current value is
> read from the packet dereferencing 4 bytes at mpls_hdr(): ensure that
> the label is contained in the skb "linear" area.
> 
> Found by code inspection.
> 
> Fixes: d27cf5c59a12 ("net: core: add MPLS update core helper and use in OvS")
> Signed-off-by: Davide Caratti <dcaratti@redhat.com>
> 
> [...]

Here is the summary with links:
  - [net] net: openvswitch: ensure LSE is pullable before reading it
    https://git.kernel.org/netdev/net/c/43c13605bad4

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html