netdev - ip link vf info truncating with many VFs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 28 Feb 2020 16:33:40 -0800
From:   Jacob Keller <jacob.e.keller@...el.com>
To:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        Florian Westphal <fw@...len.de>, Thomas Graf <tgraf@...g.ch>
Subject: ip link vf info truncating with many VFs

Hi,

I recently noticed an issue in the rtnetlink API for obtaining VF
information.

If a device creates 222 or more VF devices, the rtnl_fill_vf function
will incorrectly label the size of the IFLA_VFINFO_LIST attribute. This
occurs because rtnl_fill_vfinfo will have added more than 65k (maximum
size of a single attribute since nla_len is a __u16).

This causes the calculation in nla_nest_end to overflow and report a
significantly shorter length value. Worse case, with 222 VFs, the "ip
link show <device>" reports no VF info at all.

For some reason, the nla_put calls do not trigger an EMSGSIZE error,
because the skb itself is capable of holding the data.

I think the right thing is probably to do some sort of
overflow-protected calculation and print a warning... or find a way to
fix nla_put to error with -EMSGSIZE if we would exceed the nested
attribute size limit... I am not sure how to do that at a glance.

Thanks,
Jake