netdev - Re: [ovs-dev] [PATCH net] net: ovs: prevent underflow in queue_userspace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <740fcd03-9c02-4911-8165-a912a97a6556@stanley.mountain>
Date: Mon, 27 Jan 2025 11:08:51 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: Aaron Conole <aconole@...hat.com>
Cc: William Tu <u9012063@...il.com>, dev@...nvswitch.org,
	netdev@...r.kernel.org, kernel-janitors@...r.kernel.org,
	linux-kernel@...r.kernel.org, Eric Dumazet <edumazet@...gle.com>,
	Simon Horman <horms@...nel.org>, Jakub Kicinski <kuba@...nel.org>,
	Paolo Abeni <pabeni@...hat.com>,
	"David S. Miller" <davem@...emloft.net>
Subject: Re: [ovs-dev] [PATCH net] net: ovs: prevent underflow in
 queue_userspace_packet()

On Fri, Jan 24, 2025 at 07:42:26PM -0500, Aaron Conole wrote:
> Dan Carpenter <dan.carpenter@...aro.org> writes:
> 
> > If "hlen" less than "cutlen" then when we call upcall_msg_size()
> > the "hlen - cutlen" parameter will be a very high positive
> > number.
> >
> > Later in the function we use "skb->len - cutlen" but this change
> > addresses that potential underflow since skb->len is always going to
> > be greater than or equal to hlen.
> >
> > Fixes: f2a4d086ed4c ("openvswitch: Add packet truncation support.")
> > Signed-off-by: Dan Carpenter <dan.carpenter@...aro.org>
> > ---
> > From code review not testing.
> 
> I think it's pretty difficult to trigger this case.  'cutlen' will only
> be set by a TRUNC action attribute, which does a length check there.
> 

Ah.  Yes.  You're right.  I assumed that since we neede to do a upper
bounds check on skb->len then probably the lower bounds needed to be
checked too but that's not correct.  My bad.  No need to do anything
here because the code is fine as-is.

net/openvswitch/actions.c
  1402                  case OVS_ACTION_ATTR_TRUNC: {
  1403                          struct ovs_action_trunc *trunc = nla_data(a);
  1404  
  1405                          if (skb->len > trunc->max_len)
  1406                                  OVS_CB(skb)->cutlen = skb->len - trunc->max_len;
  1407                          break;
  1408                  }

regards,
dan carpenter