netdev - Re: [PATCH net] mctp i2c: handle NULL header address

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e53bf7e851fc90945d54860d37bff7e92b0cd5ae.camel@codeconstruct.com.au>
Date: Sat, 19 Oct 2024 12:03:48 +0800
From: Matt Johnston <matt@...econstruct.com.au>
To: Simon Horman <horms@...nel.org>
Cc: Jeremy Kerr <jk@...econstruct.com.au>, "David S. Miller"
 <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski
 <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, netdev@...r.kernel.org,
  stable@...r.kernel.org, Dung Cao <dung@...amperecomputing.com>
Subject: Re: [PATCH net] mctp i2c: handle NULL header address

Hi Simon,

On Fri, 2024-10-18 at 21:06 +0100, Simon Horman wrote:
> On Fri, Oct 18, 2024 at 11:07:56AM +0800, Matt Johnston via B4 Relay wrote:
> > From: Matt Johnston <matt@...econstruct.com.au>
> > 
> > daddr can be NULL if there is no neighbour table entry present,
> > in that case the tx packet should be dropped.
> 
> Hi Matt,
> 
> Is there also a situation where saddr can be null?
> The patch adds that check but it isn't mentioned here.

AF_MCTP protocol will always have saddr set, but it may be possible to route 
other protocols out a mctp-i2c interface where saddr=NULL.
(Perhaps other protocols should be prevented separately?)
I'll update the commit message.

> > Fixes: f5b8abf9fc3d ("mctp i2c: MCTP I2C binding driver")
> > Cc: stable@...r.kernel.org
> > Reported-by: Dung Cao <dung@...amperecomputing.com>
> > Signed-off-by: Matt Johnston <matt@...econstruct.com.au>
> > ---
> >  drivers/net/mctp/mctp-i2c.c | 3 +++
> >  1 file changed, 3 insertions(+)
> > 
> > diff --git drivers/net/mctp/mctp-i2c.c drivers/net/mctp/mctp-i2c.c
> > index 4dc057c121f5..e70fb6687994 100644
> > --- drivers/net/mctp/mctp-i2c.c
> > +++ drivers/net/mctp/mctp-i2c.c
> 
> Unfortunately tooling expects an extra level of the directory hierarchy,
> something like the following. And is unable to apply this patch in
> it's current form.

Sorry, this was my first time using b4 [1].

Cheers,
Matt

[1]
https://lore.kernel.org/tools/20241019-pr-diff-prefix-v1-1-435e6c256e2f@codeconstruct.com.au/T/#u

> 
> diff --git a/drivers/net/mctp/mctp-i2c.c b/drivers/net/mctp/mctp-i2c.c
> index 4dc057c121f5..e70fb6687994 100644
> --- a/drivers/net/mctp/mctp-i2c.c
> +++ b/drivers/net/mctp/mctp-i2c.c
> 
> > @@ -588,6 +588,9 @@ static int mctp_i2c_header_create(struct sk_buff *skb, struct net_device *dev,
> >  	if (len > MCTP_I2C_MAXMTU)
> >  		return -EMSGSIZE;
> >  
> > +	if (!daddr || !saddr)
> > +		return -EINVAL;
> > +
> >  	lldst = *((u8 *)daddr);
> >  	llsrc = *((u8 *)saddr);
> >  
> > 
> > ---
>