netdev - Re: [PATCH] ipv6: ensure ip6_dst_mtu_forward() returns at least IPV6_MIN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <0b6324f8-f49b-3d69-f792-81acf4fb2ec5@gmail.com>
Date:   Mon, 7 Jun 2021 19:16:26 -0600
From:   David Ahern <dsahern@...il.com>
To:     Maciej Żenczykowski <zenczykowski@...il.com>,
        Maciej Żenczykowski <maze@...gle.com>
Cc:     Linux Network Development Mailing List <netdev@...r.kernel.org>,
        "David S . Miller" <davem@...emloft.net>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        David Ahern <dsahern@...nel.org>,
        Jakub Kicinski <kuba@...nel.org>
Subject: Re: [PATCH] ipv6: ensure ip6_dst_mtu_forward() returns at least
 IPV6_MIN_MTU

On 6/7/21 5:43 PM, Maciej Żenczykowski wrote:
> From: Maciej Żenczykowski <maze@...gle.com>
> 
> ip6_dst_mtu_forward() has just two call sites, one of which already
> enforces the minimum mtu (which we can now remove), but it does
> materially affect the other (presumably buggy) call site in:
>   net/netfilter/nf_flow_table_core.c
>   flow_offload_fill_route()
> 
> Cc: David S. Miller <davem@...emloft.net>
> Cc: Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>
> Cc: David Ahern <dsahern@...nel.org>
> Cc: Jakub Kicinski <kuba@...nel.org>
> Signed-off-by: Maciej Żenczykowski <maze@...gle.com>
> ---
>  include/net/ip6_route.h | 4 ++--
>  net/ipv6/ip6_output.c   | 2 --
>  2 files changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
> index 9dd3c75a4d62..e01364c0821d 100644
> --- a/include/net/ip6_route.h
> +++ b/include/net/ip6_route.h
> @@ -315,14 +315,14 @@ static inline unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
>  	unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);

we can prevent a route getting an mtu as a metric that is < IPV6_MIN_MTU.

>  
>  	if (mtu)
> -		return mtu;
> +		return max_t(unsigned int, mtu, IPV6_MIN_MTU);
>  
>  	rcu_read_lock();
>  	idev = __in6_dev_get(dst->dev);
>  	mtu = idev ? idev->cnf.mtu6 : IPV6_MIN_MTU;

and we can prevent cnf.mtu6 getting set < IPV6_MIN_MTU:

addrconf_notify(), NETDEV_CHANGEMTU case.
ipv6_add_dev() already requires dev->mtu to be > IPV6_MIN_MTU
ndisc_router_discovery requires it.

so it seems implausible for the idev to get a value below the minimum.

the metric is less clear that it is checked, so it would be the one to
make sure is meeting expectations.