netdev - Re: [PATCH net] net_sched: cls_flow: validate TCA_FLOW

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: 
 <173601003376.2470506.3933525415980979129.git-patchwork-notify@kernel.org>
Date: Sat, 04 Jan 2025 17:00:33 +0000
From: patchwork-bot+netdevbpf@...nel.org
To: Eric Dumazet <edumazet@...gle.com>
Cc: davem@...emloft.net, kuba@...nel.org, pabeni@...hat.com, jhs@...atatu.com,
 victor@...atatu.com, xiyou.wangcong@...il.com, jiri@...nulli.us,
 netdev@...r.kernel.org, eric.dumazet@...il.com,
 syzbot+1dbb57d994e54aaa04d2@...kaller.appspotmail.com
Subject: Re: [PATCH net] net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@...nel.org>:

On Fri,  3 Jan 2025 10:45:46 +0000 you wrote:
> syzbot found that TCA_FLOW_RSHIFT attribute was not validated.
> Right shitfing a 32bit integer is undefined for large shift values.
> 
> UBSAN: shift-out-of-bounds in net/sched/cls_flow.c:329:23
> shift exponent 9445 is too large for 32-bit type 'u32' (aka 'unsigned int')
> CPU: 1 UID: 0 PID: 54 Comm: kworker/u8:3 Not tainted 6.13.0-rc3-syzkaller-00180-g4f619d518db9 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Workqueue: ipv6_addrconf addrconf_dad_work
> Call Trace:
>  <TASK>
>   __dump_stack lib/dump_stack.c:94 [inline]
>   dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
>   ubsan_epilogue lib/ubsan.c:231 [inline]
>   __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468
>   flow_classify+0x24d5/0x25b0 net/sched/cls_flow.c:329
>   tc_classify include/net/tc_wrapper.h:197 [inline]
>   __tcf_classify net/sched/cls_api.c:1771 [inline]
>   tcf_classify+0x420/0x1160 net/sched/cls_api.c:1867
>   sfb_classify net/sched/sch_sfb.c:260 [inline]
>   sfb_enqueue+0x3ad/0x18b0 net/sched/sch_sfb.c:318
>   dev_qdisc_enqueue+0x4b/0x290 net/core/dev.c:3793
>   __dev_xmit_skb net/core/dev.c:3889 [inline]
>   __dev_queue_xmit+0xf0e/0x3f50 net/core/dev.c:4400
>   dev_queue_xmit include/linux/netdevice.h:3168 [inline]
>   neigh_hh_output include/net/neighbour.h:523 [inline]
>   neigh_output include/net/neighbour.h:537 [inline]
>   ip_finish_output2+0xd41/0x1390 net/ipv4/ip_output.c:236
>   iptunnel_xmit+0x55d/0x9b0 net/ipv4/ip_tunnel_core.c:82
>   udp_tunnel_xmit_skb+0x262/0x3b0 net/ipv4/udp_tunnel_core.c:173
>   geneve_xmit_skb drivers/net/geneve.c:916 [inline]
>   geneve_xmit+0x21dc/0x2d00 drivers/net/geneve.c:1039
>   __netdev_start_xmit include/linux/netdevice.h:5002 [inline]
>   netdev_start_xmit include/linux/netdevice.h:5011 [inline]
>   xmit_one net/core/dev.c:3590 [inline]
>   dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3606
>   __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4434
> 
> [...]

Here is the summary with links:
  - [net] net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
    https://git.kernel.org/netdev/net/c/a039e54397c6

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html