linux-kernel - Re: [ovs-dev] [PATCH net] net: ovs: prevent underflow in queue_userspace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f7th65nhggd.fsf@redhat.com>
Date: Fri, 24 Jan 2025 19:42:26 -0500
From: Aaron Conole <aconole@...hat.com>
To: Dan Carpenter <dan.carpenter@...aro.org>
Cc: William Tu <u9012063@...il.com>,  dev@...nvswitch.org,
  netdev@...r.kernel.org,  kernel-janitors@...r.kernel.org,
  linux-kernel@...r.kernel.org,  Eric Dumazet <edumazet@...gle.com>,  Simon
 Horman <horms@...nel.org>,  Jakub Kicinski <kuba@...nel.org>,  Paolo Abeni
 <pabeni@...hat.com>,  "David S. Miller" <davem@...emloft.net>
Subject: Re: [ovs-dev] [PATCH net] net: ovs: prevent underflow in
 queue_userspace_packet()

Dan Carpenter <dan.carpenter@...aro.org> writes:

> If "hlen" less than "cutlen" then when we call upcall_msg_size()
> the "hlen - cutlen" parameter will be a very high positive
> number.
>
> Later in the function we use "skb->len - cutlen" but this change
> addresses that potential underflow since skb->len is always going to
> be greater than or equal to hlen.
>
> Fixes: f2a4d086ed4c ("openvswitch: Add packet truncation support.")
> Signed-off-by: Dan Carpenter <dan.carpenter@...aro.org>
> ---
> From code review not testing.

I think it's pretty difficult to trigger this case.  'cutlen' will only
be set by a TRUNC action attribute, which does a length check there.

>  net/openvswitch/datapath.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
> index 225f6048867f..bb25a2bbe8a0 100644
> --- a/net/openvswitch/datapath.c
> +++ b/net/openvswitch/datapath.c
> @@ -477,6 +477,11 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
>  	else
>  		hlen = skb->len;
>  
> +	if (hlen < cutlen) {
> +		err = -EINVAL;
> +		goto out;
> +	}
> +

I think the right change would be more like:

	if (hlen < cutlen)
		cutlen = 0;

Since trunc is supposed to be a cap on the length to trim
the packet.  If the cut length would be longer than the
packet, then the whole packet should fit.

>  	len = upcall_msg_size(upcall_info, hlen - cutlen,
>  			      OVS_CB(skb)->acts_origlen);
>  	user_skb = genlmsg_new(len, GFP_ATOMIC);