netdev - Re: [PATCH net] ipv4/route: fail early when inet dev is missing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <cdad7c2b-b4e3-7f3b-0f48-7b2553e14167@cumulusnetworks.com>
Date:   Tue, 5 Mar 2019 08:45:02 -0700
From:   David Ahern <dsa@...ulusnetworks.com>
To:     Paolo Abeni <pabeni@...hat.com>, netdev@...r.kernel.org
Cc:     "David S. Miller" <davem@...emloft.net>
Subject: Re: [PATCH net] ipv4/route: fail early when inet dev is missing

On 3/5/19 5:49 AM, Paolo Abeni wrote:
> If a non local multicast packet reaches ip_route_input_rcu() while
> the ingress device is NULL, we end up doing a NULL pointer

A clarification: the ingress device is not NULL; it's the IPv4 private
data (in_device).

> dereference in IN_DEV_MFORWARD().
> 
> Since the later call to ip_route_input_mc() is going to fail if
> !in_dev, we can fail early in such scenario and avoid the dangerous
> code path.
> 
> Reported-by: Tianhao Zhao <tizhao@...hat.com>
> Fixes: e58e41596811 ("net: Enable support for VRF with ipv4 multicast")
> Signed-off-by: Paolo Abeni <pabeni@...hat.com>
> ---
>  net/ipv4/route.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/net/ipv4/route.c b/net/ipv4/route.c
> index 7bb9128c8363..e40e56e014a0 100644
> --- a/net/ipv4/route.c
> +++ b/net/ipv4/route.c
> @@ -2144,12 +2144,13 @@ int ip_route_input_rcu(struct sk_buff *skb, __be32 daddr, __be32 saddr,
>  		int our = 0;
>  		int err = -EINVAL;
>  
> -		if (in_dev)
> -			our = ip_check_mc_rcu(in_dev, daddr, saddr,
> -					      ip_hdr(skb)->protocol);
> +		if (!in_dev)
> +			return err;

The point of e58e41596811 was to allow multicast address on the VRF
device for Rx (I believe Allied Tellesis relies on that). I think the
logic needs another tweak to properly handle that case and account for
no ipv4 struct on the ingress device. I will have to come back to it
when I have time to setup a test case. For now, tracing ip_check_mc_rcu
to ip_mc_validate_source, you are correct. We can bail here if in_dev is
NULL on the real ingress device.

Reviewed-by: David Ahern <dsahern@...il.com>

> +		our = ip_check_mc_rcu(in_dev, daddr, saddr,
> +				      ip_hdr(skb)->protocol);
>  
>  		/* check l3 master if no match yet */
> -		if ((!in_dev || !our) && netif_is_l3_slave(dev)) {
> +		if (!our && netif_is_l3_slave(dev)) {
>  			struct in_device *l3_in_dev;
>  
>  			l3_in_dev = __in_dev_get_rcu(skb->dev);
>