netdev - Re: [PATCH net] openvswitch: Don't swap table in nlattr_set() after OVS_ATTR

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 04 May 2018 12:51:37 -0400 (EDT)
From:   David Miller <davem@...emloft.net>
To:     sbrivio@...hat.com
Cc:     pshelar@....org, liuhangbin@...il.com, sd@...asysnail.net,
        jesse@...ira.com, netdev@...r.kernel.org, dev@...nvswitch.org
Subject: Re: [PATCH net] openvswitch: Don't swap table in nlattr_set()
 after OVS_ATTR_NESTED is found

From: Stefano Brivio <sbrivio@...hat.com>
Date: Thu,  3 May 2018 18:13:25 +0200

> If an OVS_ATTR_NESTED attribute type is found while walking
> through netlink attributes, we call nlattr_set() recursively
> passing the length table for the following nested attributes, if
> different from the current one.
> 
> However, once we're done with those sub-nested attributes, we
> should continue walking through attributes using the current
> table, instead of using the one related to the sub-nested
> attributes.
> 
> For example, given this sequence:
> 
> 1  OVS_KEY_ATTR_PRIORITY
> 2  OVS_KEY_ATTR_TUNNEL
> 3	OVS_TUNNEL_KEY_ATTR_ID
> 4	OVS_TUNNEL_KEY_ATTR_IPV4_SRC
> 5	OVS_TUNNEL_KEY_ATTR_IPV4_DST
> 6	OVS_TUNNEL_KEY_ATTR_TTL
> 7	OVS_TUNNEL_KEY_ATTR_TP_SRC
> 8	OVS_TUNNEL_KEY_ATTR_TP_DST
> 9  OVS_KEY_ATTR_IN_PORT
> 10 OVS_KEY_ATTR_SKB_MARK
> 11 OVS_KEY_ATTR_MPLS
> 
> we switch to the 'ovs_tunnel_key_lens' table on attribute #3,
> and we don't switch back to 'ovs_key_lens' while setting
> attributes #9 to #11 in the sequence. As OVS_KEY_ATTR_MPLS
> evaluates to 21, and the array size of 'ovs_tunnel_key_lens' is
> 15, we also get this kind of KASan splat while accessing the
> wrong table:
 ...
> Reported-by: Hangbin Liu <liuhangbin@...il.com>
> Fixes: 982b52700482 ("openvswitch: Fix mask generation for nested attributes.")
> Signed-off-by: Stefano Brivio <sbrivio@...hat.com>
> Reviewed-by: Sabrina Dubroca <sd@...asysnail.net>

Looks good, applied and queued up for -stable.

Thanks.