linux-kernel - Re: [PATCH v2] net: dsa: felix: check felix_cpu_port_for

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250326192259.e3m7ydgkeo2ix6wb@skbuf>
Date: Wed, 26 Mar 2025 21:22:59 +0200
From: Vladimir Oltean <vladimir.oltean@....com>
To: Vitaliy Shevtsov <v.shevtsov@...integration.ru>
Cc: Claudiu Manoil <claudiu.manoil@....com>,
	Alexandre Belloni <alexandre.belloni@...tlin.com>,
	UNGLinuxDriver@...rochip.com, Andrew Lunn <andrew@...n.ch>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
	lvc-project@...uxtesting.org
Subject: Re: [PATCH v2] net: dsa: felix: check felix_cpu_port_for_conduit()
 for failure

Hello Vitaliy,

On Wed, Mar 26, 2025 at 11:34:57PM +0500, Vitaliy Shevtsov wrote:
> felix_cpu_port_for_conduit() can return a negative value in case of failure
> and then it will be used as a port index causing buffer underflow. This can
> happen if a bonding interface in 802.1Q mode has no ports. This is unlikely
> to happen because the underlying driver handles IFF_TEAM, IFF_MASTER,
> IFF_BONDING bits and ports populating correctly, it is still better to
> check this for correctness if somehow it fails.

If the bonding interface has no ports, it is not a DSA conduit.

See the logic in dsa_conduit_changeupper() which, starting from "dev"
which is known to be a DSA conduit, it looks at info->upper_dev which is
a LAG device, and calls dsa_conduit_lag_join() when it is linking with
it. Thus, the LAG device (info->upper_dev) has at least one port: dev.

Also see this comment and walk through the dsa_conduit_lag_leave() path:

		/* If the LAG DSA conduit has no ports left, migrate back all
		 * user ports to the first physical CPU port
		 */

Given the justification provided thus far, I don't see a reason to merge
this patch. The "somehow it fails" needs to be a bit more clear.