netdev - Re: [PATCH net-next v4 12/17] net: pktgen: fix mpls maximum labels list parsing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250206130456.GQ554665@kernel.org>
Date: Thu, 6 Feb 2025 13:04:56 +0000
From: Simon Horman <horms@...nel.org>
To: Peter Seiderer <ps.report@....net>
Cc: netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
	linux-kselftest@...r.kernel.org,
	"David S . Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Shuah Khan <shuah@...nel.org>
Subject: Re: [PATCH net-next v4 12/17] net: pktgen: fix mpls maximum labels
 list parsing

On Wed, Feb 05, 2025 at 02:11:48PM +0100, Peter Seiderer wrote:
> Fix mpls maximum labels list parsing up to MAX_MPLS_LABELS/16 entries
> (instead of up to MAX_MPLS_LABELS - 1).
> 
> Fixes:

"Fixes: " has a special meaning, it  is recognised as a tag by tooling, and
implies a bug fix. Please consider some other way of describing this, e.g.

Addresses the following:

> 
> 	$ echo "mpls 00000f00,00000f01,00000f02,00000f03,00000f04,00000f05,00000f06,00000f07,00000f08,00000f09,00000f0a,00000f0b,00000f0c,00000f0d,00000f0e,00000f0f" > /proc/net/pktgen/lo\@0
> 	-bash: echo: write error: Argument list too long
> 
> Signed-off-by: Peter Seiderer <ps.report@....net>
> ---
> Changes v3 -> v4
>   - new patch (factored out of patch 'net: pktgen: fix access outside of user
>     given buffer in pktgen_if_write()')
> ---
>  net/core/pktgen.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/net/core/pktgen.c b/net/core/pktgen.c
> index 84fd88e48275..0fd15f21119b 100644
> --- a/net/core/pktgen.c
> +++ b/net/core/pktgen.c
> @@ -908,6 +908,10 @@ static int get_labels(const char __user *buffer, struct pktgen_dev *pkt_dev)
>  	pkt_dev->nr_labels = 0;
>  	do {
>  		__u32 tmp;
> +
> +		if (n >= MAX_MPLS_LABELS)
> +			return -E2BIG;
> +
>  		len = hex32_arg(&buffer[i], HEX_8_DIGITS, &tmp);
>  		if (len <= 0)
>  			return len;
> @@ -919,8 +923,6 @@ static int get_labels(const char __user *buffer, struct pktgen_dev *pkt_dev)
>  			return -EFAULT;
>  		i++;
>  		n++;
> -		if (n >= MAX_MPLS_LABELS)
> -			return -E2BIG;
>  	} while (c == ',');
>  
>  	pkt_dev->nr_labels = n;
> -- 
> 2.48.1
>