netdev - Re: [PATCH v3 net] net: sched: correct flower port blocking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20200217.213350.1098567982796784517.davem@davemloft.net>
Date:   Mon, 17 Feb 2020 21:33:50 -0800 (PST)
From:   David Miller <davem@...emloft.net>
To:     jbaron@...mai.com
Cc:     jiri@...nulli.us, xiyou.wangcong@...il.com, jhs@...atatu.com,
        netdev@...r.kernel.org, soukjin.bae@...sung.com,
        edumazet@...gle.com
Subject: Re: [PATCH v3 net] net: sched: correct flower port blocking

From: Jason Baron <jbaron@...mai.com>
Date: Mon, 17 Feb 2020 15:38:09 -0500

> tc flower rules that are based on src or dst port blocking are sometimes
> ineffective due to uninitialized stack data. __skb_flow_dissect() extracts
> ports from the skb for tc flower to match against. However, the port
> dissection is not done when when the FLOW_DIS_IS_FRAGMENT bit is set in
> key_control->flags. All callers of __skb_flow_dissect(), zero-out the
> key_control field except for fl_classify() as used by the flower
> classifier. Thus, the FLOW_DIS_IS_FRAGMENT may be set on entry to
> __skb_flow_dissect(), since key_control is allocated on the stack
> and may not be initialized.
> 
> Since key_basic and key_control are present for all flow keys, let's
> make sure they are initialized.
> 
> Fixes: 62230715fd24 ("flow_dissector: do not dissect l4 ports for fragments")
> Co-developed-by: Eric Dumazet <edumazet@...gle.com>
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Acked-by: Cong Wang <xiyou.wangcong@...il.com>
> Signed-off-by: Jason Baron <jbaron@...mai.com>

Applied and queued up for -stable, thanks Jason.