| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <YRIhwQ3ji8eqPQOQ@unreal>
Date: Tue, 10 Aug 2021 09:50:41 +0300
From: Leon Romanovsky <leon@...nel.org>
To: Vladimir Oltean <vladimir.oltean@....com>
Cc: netdev@...r.kernel.org, Jakub Kicinski <kuba@...nel.org>,
"David S. Miller" <davem@...emloft.net>,
Andrew Lunn <andrew@...n.ch>,
Florian Fainelli <f.fainelli@...il.com>,
Vivien Didelot <vivien.didelot@...il.com>,
Vladimir Oltean <olteanv@...il.com>,
Vadym Kochan <vkochan@...vell.com>,
Taras Chornyi <tchornyi@...vell.com>,
Saeed Mahameed <saeedm@...dia.com>,
Jiri Pirko <jiri@...dia.com>, Ido Schimmel <idosch@...dia.com>,
Lars Povlsen <lars.povlsen@...rochip.com>,
Steen Hegelund <Steen.Hegelund@...rochip.com>,
UNGLinuxDriver@...rochip.com,
Grygorii Strashko <grygorii.strashko@...com>,
Julian Wiedmann <jwi@...ux.ibm.com>,
Karsten Graul <kgraul@...ux.ibm.com>,
Heiko Carstens <hca@...ux.ibm.com>,
Vasily Gorbik <gor@...ux.ibm.com>,
Christian Borntraeger <borntraeger@...ibm.com>,
Jianbo Liu <jianbol@...dia.com>,
Vlad Buslov <vladbu@...dia.com>,
Bjarni Jonasson <bjarni.jonasson@...rochip.com>,
Vignesh Raghavendra <vigneshr@...com>,
Tobias Waldekranz <tobias@...dekranz.com>,
linux-kernel@...r.kernel.org, linux-rdma@...r.kernel.org,
linux-arm-kernel@...ts.infradead.org, linux-omap@...r.kernel.org,
linux-s390@...r.kernel.org, Ido Schimmel <idosch@...sch.org>
Subject: Re: [PATCH net] net: switchdev: zero-initialize struct
switchdev_notifier_fdb_info emitted by drivers towards the bridge
On Mon, Aug 09, 2021 at 04:11:52PM +0300, Vladimir Oltean wrote:
> The blamed commit a new field to struct switchdev_notifier_fdb_info, but
> did not make sure that all call paths set it to something valid. For
> example, a switchdev driver may emit a SWITCHDEV_FDB_ADD_TO_BRIDGE
> notifier, and since the 'is_local' flag is not set, it contains junk
> from the stack, so the bridge might interpret those notifications as
> being for local FDB entries when that was not intended.
>
> To avoid that now and in the future, zero-initialize all
> switchdev_notifier_fdb_info structures created by drivers such that all
> newly added fields to not need to touch drivers again.
>
> Fixes: 2c4eca3ef716 ("net: bridge: switchdev: include local flag in FDB notifications")
> Reported-by: Ido Schimmel <idosch@...sch.org>
> Signed-off-by: Vladimir Oltean <vladimir.oltean@....com>
> ---
> drivers/net/ethernet/marvell/prestera/prestera_switchdev.c | 2 ++
> drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c | 1 +
> drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 2 ++
> drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 1 +
> drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c | 1 +
> drivers/net/ethernet/rocker/rocker_main.c | 1 +
> drivers/net/ethernet/rocker/rocker_ofdpa.c | 1 +
> drivers/net/ethernet/ti/am65-cpsw-switchdev.c | 1 +
> drivers/net/ethernet/ti/cpsw_switchdev.c | 1 +
> drivers/s390/net/qeth_l2_main.c | 2 ++
> net/dsa/slave.c | 1 +
> 11 files changed, 14 insertions(+)
>
> diff --git a/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c b/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c
> index 0b3e8f2db294..cf60e80dd3ba 100644
> --- a/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c
> +++ b/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c
> @@ -750,6 +750,7 @@ prestera_fdb_offload_notify(struct prestera_port *port,
> {
> struct switchdev_notifier_fdb_info send_info;
>
> + memset(&send_info, 0, sizeof(send_info));
This can be written simpler.
struct switchdev_notifier_fdb_info send_info = {};
In all places.
Thanks
> send_info.addr = info->addr;
> send_info.vid = info->vid;
> send_info.offloaded = true;
> @@ -1146,6 +1147,7 @@ static void prestera_fdb_event(struct prestera_switch *sw,
> if (!dev)
> return;
>
> + memset(&info, 0, sizeof(info));
> info.addr = evt->fdb_evt.data.mac;
> info.vid = evt->fdb_evt.vid;
> info.offloaded = true;
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c
> index a6e1d4f78268..77e09397a062 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c
> @@ -71,6 +71,7 @@ mlx5_esw_bridge_fdb_offload_notify(struct net_device *dev, const unsigned char *
> {
> struct switchdev_notifier_fdb_info send_info;
>
> + memset(&send_info, 0, sizeof(send_info));
> send_info.addr = addr;
> send_info.vid = vid;
> send_info.offloaded = true;
> diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
> index 7e221ef01437..8a7660f2d048 100644
> --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
> +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
> @@ -9086,6 +9086,7 @@ static void mlxsw_sp_rif_fid_fdb_del(struct mlxsw_sp_rif *rif, const char *mac)
> if (!dev)
> return;
>
> + memset(&info, 0, sizeof(info));
> info.addr = mac;
> info.vid = 0;
> call_switchdev_notifiers(SWITCHDEV_FDB_DEL_TO_BRIDGE, dev, &info.info,
> @@ -9137,6 +9138,7 @@ static void mlxsw_sp_rif_vlan_fdb_del(struct mlxsw_sp_rif *rif, const char *mac)
> if (!dev)
> return;
>
> + memset(&info, 0, sizeof(info));
> info.addr = mac;
> info.vid = vid;
> call_switchdev_notifiers(SWITCHDEV_FDB_DEL_TO_BRIDGE, dev, &info.info,
> diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
> index c5ef9aa64efe..f016d909bead 100644
> --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
> +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
> @@ -2510,6 +2510,7 @@ mlxsw_sp_fdb_call_notifiers(enum switchdev_notifier_type type,
> {
> struct switchdev_notifier_fdb_info info;
>
> + memset(&info, 0, sizeof(info));
> info.addr = mac;
> info.vid = vid;
> info.offloaded = offloaded;
> diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c b/drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c
> index 0443f66b5550..fbc3f5e65882 100644
> --- a/drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c
> +++ b/drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c
> @@ -279,6 +279,7 @@ static void sparx5_fdb_call_notifiers(enum switchdev_notifier_type type,
> {
> struct switchdev_notifier_fdb_info info;
>
> + memset(&info, 0, sizeof(info));
> info.addr = mac;
> info.vid = vid;
> info.offloaded = offloaded;
> diff --git a/drivers/net/ethernet/rocker/rocker_main.c b/drivers/net/ethernet/rocker/rocker_main.c
> index a46633606cae..49d548be9fe4 100644
> --- a/drivers/net/ethernet/rocker/rocker_main.c
> +++ b/drivers/net/ethernet/rocker/rocker_main.c
> @@ -2717,6 +2717,7 @@ rocker_fdb_offload_notify(struct rocker_port *rocker_port,
> {
> struct switchdev_notifier_fdb_info info;
>
> + memset(&info, 0, sizeof(info));
> info.addr = recv_info->addr;
> info.vid = recv_info->vid;
> info.offloaded = true;
> diff --git a/drivers/net/ethernet/rocker/rocker_ofdpa.c b/drivers/net/ethernet/rocker/rocker_ofdpa.c
> index 967a634ee9ac..7d954fd24134 100644
> --- a/drivers/net/ethernet/rocker/rocker_ofdpa.c
> +++ b/drivers/net/ethernet/rocker/rocker_ofdpa.c
> @@ -1824,6 +1824,7 @@ static void ofdpa_port_fdb_learn_work(struct work_struct *work)
> bool learned = (lw->flags & OFDPA_OP_FLAG_LEARNED);
> struct switchdev_notifier_fdb_info info;
>
> + memset(&info, 0, sizeof(info));
> info.addr = lw->addr;
> info.vid = lw->vid;
>
> diff --git a/drivers/net/ethernet/ti/am65-cpsw-switchdev.c b/drivers/net/ethernet/ti/am65-cpsw-switchdev.c
> index 9c29b363e9ae..81d2b1765a66 100644
> --- a/drivers/net/ethernet/ti/am65-cpsw-switchdev.c
> +++ b/drivers/net/ethernet/ti/am65-cpsw-switchdev.c
> @@ -360,6 +360,7 @@ static void am65_cpsw_fdb_offload_notify(struct net_device *ndev,
> {
> struct switchdev_notifier_fdb_info info;
>
> + memset(&info, 0, sizeof(info));
> info.addr = rcv->addr;
> info.vid = rcv->vid;
> info.offloaded = true;
> diff --git a/drivers/net/ethernet/ti/cpsw_switchdev.c b/drivers/net/ethernet/ti/cpsw_switchdev.c
> index f7fb6e17dadd..446bdab06bdd 100644
> --- a/drivers/net/ethernet/ti/cpsw_switchdev.c
> +++ b/drivers/net/ethernet/ti/cpsw_switchdev.c
> @@ -370,6 +370,7 @@ static void cpsw_fdb_offload_notify(struct net_device *ndev,
> {
> struct switchdev_notifier_fdb_info info;
>
> + memset(&info, 0, sizeof(info));
> info.addr = rcv->addr;
> info.vid = rcv->vid;
> info.offloaded = true;
> diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
> index 2abf86c104d5..843dd4f4d8d7 100644
> --- a/drivers/s390/net/qeth_l2_main.c
> +++ b/drivers/s390/net/qeth_l2_main.c
> @@ -283,6 +283,7 @@ static void qeth_l2_dev2br_fdb_flush(struct qeth_card *card)
>
> QETH_CARD_TEXT(card, 2, "fdbflush");
>
> + memset(&info, 0, sizeof(info));
> info.addr = NULL;
> /* flush all VLANs: */
> info.vid = 0;
> @@ -693,6 +694,7 @@ static void qeth_l2_dev2br_fdb_notify(struct qeth_card *card, u8 code,
> if (qeth_is_my_net_if_token(card, token))
> return;
>
> + memset(&info, 0, sizeof(info));
> info.addr = ntfy_mac;
> /* don't report VLAN IDs */
> info.vid = 0;
> diff --git a/net/dsa/slave.c b/net/dsa/slave.c
> index 532085da8d8f..1cb7f7e56784 100644
> --- a/net/dsa/slave.c
> +++ b/net/dsa/slave.c
> @@ -2298,6 +2298,7 @@ dsa_fdb_offload_notify(struct dsa_switchdev_event_work *switchdev_work)
> if (!dsa_is_user_port(ds, switchdev_work->port))
> return;
>
> + memset(&info, 0, sizeof(info));
> info.addr = switchdev_work->addr;
> info.vid = switchdev_work->vid;
> info.offloaded = true;
> --
> 2.25.1
>
Powered by blists - more mailing lists