From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B31D5C678D5 for ; Tue, 7 Mar 2023 18:45:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232873AbjCGSps (ORCPT ); Tue, 7 Mar 2023 13:45:48 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35246 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232925AbjCGSpO (ORCPT ); Tue, 7 Mar 2023 13:45:14 -0500 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 348A0A9DC9 for ; Tue, 7 Mar 2023 10:34:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1678213989; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=2ky9dYKwxEvaHQ/+rcftd+ezGjDIRTSsKEhlT3yu3PY=; b=e2CCvezIE60CsWy7sdzu6wyH1vu2cIcMB5myvuT2QPhRfPBWt5lHCuAfBO0OnqW/m0EC1k eLlSm5RENkz1wVG5QQj+pFABy0Fr3OJl4IUD5J/ceswzlb2Eg6uaz4q0MrsWi8mDXP+IVc Q3/LQRapfQqS3eBmUpyAK4uPaq19NaI= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-315-tldqTq31Psu876WkwGHu2Q-1; Tue, 07 Mar 2023 13:33:02 -0500 X-MC-Unique: tldqTq31Psu876WkwGHu2Q-1 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 48997185A794; Tue, 7 Mar 2023 18:33:01 +0000 (UTC) Received: from RHTPC1VM0NT (unknown [10.22.32.201]) by smtp.corp.redhat.com (Postfix) with ESMTPS id B57762026D68; Tue, 7 Mar 2023 18:33:00 +0000 (UTC) From: Aaron Conole To: Xin Long Cc: netfilter-devel@vger.kernel.org, network dev , Pablo Neira Ayuso , Jozsef Kadlecsik , Florian Westphal , davem@davemloft.net, kuba@kernel.org, Eric Dumazet , Paolo Abeni , Roopa Prabhu , Nikolay Aleksandrov , Pravin B Shelar Subject: Re: [PATCH nf-next 2/6] netfilter: bridge: check len before accessing more nh data References: Date: Tue, 07 Mar 2023 13:32:59 -0500 In-Reply-To: (Xin Long's message of "Fri, 3 Mar 2023 19:12:38 -0500") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-Scanned-By: MIMEDefang 3.1 on 10.11.54.4 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Xin Long writes: > In the while loop of br_nf_check_hbh_len(), similar to ip6_parse_tlv(), > before accessing 'nh[off + 1]', it should add a check 'len < 2'; and > before parsing IPV6_TLV_JUMBO, it should add a check 'optlen > len', > in case of overflows. > > Signed-off-by: Xin Long > --- Reviewed-by: Aaron Conole > net/bridge/br_netfilter_ipv6.c | 47 ++++++++++++++++------------------ > 1 file changed, 22 insertions(+), 25 deletions(-) > > diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c > index 5cd3e4c35123..50f564c33551 100644 > --- a/net/bridge/br_netfilter_ipv6.c > +++ b/net/bridge/br_netfilter_ipv6.c > @@ -50,54 +50,51 @@ static int br_nf_check_hbh_len(struct sk_buff *skb) > u32 pkt_len; > > if (!pskb_may_pull(skb, off + 8)) > - goto bad; > + return -1; > nh = (u8 *)(ipv6_hdr(skb) + 1); > len = (nh[1] + 1) << 3; > > if (!pskb_may_pull(skb, off + len)) > - goto bad; > + return -1; > nh = skb_network_header(skb); > > off += 2; > len -= 2; > - > while (len > 0) { > - int optlen = nh[off + 1] + 2; > - > - switch (nh[off]) { > - case IPV6_TLV_PAD1: > - optlen = 1; > - break; > + int optlen; > > - case IPV6_TLV_PADN: > - break; > + if (nh[off] == IPV6_TLV_PAD1) { > + off++; > + len--; > + continue; > + } > + if (len < 2) > + return -1; > + optlen = nh[off + 1] + 2; > + if (optlen > len) > + return -1; > > - case IPV6_TLV_JUMBO: > + if (nh[off] == IPV6_TLV_JUMBO) { > if (nh[off + 1] != 4 || (off & 3) != 2) > - goto bad; > + return -1; > pkt_len = ntohl(*(__be32 *)(nh + off + 2)); > if (pkt_len <= IPV6_MAXPLEN || > ipv6_hdr(skb)->payload_len) > - goto bad; > + return -1; > if (pkt_len > skb->len - sizeof(struct ipv6hdr)) > - goto bad; > + return -1; > if (pskb_trim_rcsum(skb, > pkt_len + sizeof(struct ipv6hdr))) > - goto bad; > + return -1; > nh = skb_network_header(skb); > - break; > - default: > - if (optlen > len) > - goto bad; > - break; > } > off += optlen; > len -= optlen; > } > - if (len == 0) > - return 0; > -bad: > - return -1; > + if (len) > + return -1; > + > + return 0; > } > > int br_validate_ipv6(struct net *net, struct sk_buff *skb)