netdev - [PATCH net-next v8 4/8] net: pktgen: fix mpls maximum labels list parsing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250227135604.40024-5-ps.report@gmx.net>
Date: Thu, 27 Feb 2025 14:56:00 +0100
From: Peter Seiderer <ps.report@....net>
To: netdev@...r.kernel.org
Cc: linux-kernel@...r.kernel.org,
	linux-kselftest@...r.kernel.org,
	"David S . Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>,
	Paolo Abeni <pabeni@...hat.com>,
	Simon Horman <horms@...nel.org>,
	Shuah Khan <shuah@...nel.org>,
	Peter Seiderer <ps.report@....net>,
	Fedor Pchelkin <pchelkin@...ras.ru>,
	Arnd Bergmann <arnd@...db.de>,
	Nam Cao <namcao@...utronix.de>
Subject: [PATCH net-next v8 4/8] net: pktgen: fix mpls maximum labels list parsing

Fix mpls maximum labels list parsing up to MAX_MPLS_LABELS entries (instead
of up to MAX_MPLS_LABELS - 1).

Addresses the following:

	$ echo "mpls 00000f00,00000f01,00000f02,00000f03,00000f04,00000f05,00000f06,00000f07,00000f08,00000f09,00000f0a,00000f0b,00000f0c,00000f0d,00000f0e,00000f0f" > /proc/net/pktgen/lo\@0
	-bash: echo: write error: Argument list too long

Signed-off-by: Peter Seiderer <ps.report@....net>
Reviewed-by: Simon Horman <horms@...nel.org>
---
Changes v7 -> v8
  - rebased on actual net-next/main
  - slightly rephrase commit message, omit '/16' (suggested by Paolo Abeni)

Changes v6 -> v7
  - rebased on actual net-next/main
  - no changes

Changes v5 -> v6
  - adjust to dropped patch 'net: pktgen: use defines for the various
    dec/hex number parsing digits lengths'
  - add rev-by Simon Horman

Changes v4 -> v5
  - split up patchset into part i/ii (suggested by Simon Horman)
  - change patch description ('Fixes:' -> 'Addresses the following:',
    suggested by Simon Horman)

Changes v3 -> v4
  - new patch (factored out of patch 'net: pktgen: fix access outside of user
    given buffer in pktgen_if_write()')
---
 net/core/pktgen.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index b678b28dedae..def35a734d9d 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -900,6 +900,10 @@ static ssize_t get_labels(const char __user *buffer, struct pktgen_dev *pkt_dev)
 	pkt_dev->nr_labels = 0;
 	do {
 		__u32 tmp;
+
+		if (n >= MAX_MPLS_LABELS)
+			return -E2BIG;
+
 		len = hex32_arg(&buffer[i], 8, &tmp);
 		if (len <= 0)
 			return len;
@@ -911,8 +915,6 @@ static ssize_t get_labels(const char __user *buffer, struct pktgen_dev *pkt_dev)
 			return -EFAULT;
 		i++;
 		n++;
-		if (n >= MAX_MPLS_LABELS)
-			return -E2BIG;
 	} while (c == ',');
 
 	pkt_dev->nr_labels = n;
-- 
2.48.1