netdev - Re: [PATCH net] tc: Ensure we have enough buffer space when sending filter netlink notifications

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <szzzagmx5jstl6hymloxwtquazgrzpqx3xr3kqqdx43w4xnldo@mjfs76uczbdr>
Date: Mon, 7 Apr 2025 13:12:41 +0200
From: Jiri Pirko <jiri@...nulli.us>
To: Toke Høiland-Jørgensen <toke@...hat.com>
Cc: Jamal Hadi Salim <jhs@...atatu.com>, 
	Cong Wang <xiyou.wangcong@...il.com>, Ilya Maximets <i.maximets@...hat.com>, 
	Frode Nordahl <frode.nordahl@...onical.com>, "David S. Miller" <davem@...emloft.net>, 
	Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, 
	Paolo Abeni <pabeni@...hat.com>, Simon Horman <horms@...nel.org>, netdev@...r.kernel.org
Subject: Re: [PATCH net] tc: Ensure we have enough buffer space when sending
 filter netlink notifications

Mon, Apr 07, 2025 at 12:55:34PM +0200, toke@...hat.com wrote:
>The tfilter_notify() and tfilter_del_notify() functions assume that
>NLMSG_GOODSIZE is always enough to dump the filter chain. This is not
>always the case, which can lead to silent notify failures (because the
>return code of tfilter_notify() is not always checked). In particular,
>this can lead to NLM_F_ECHO not being honoured even though an action
>succeeds, which forces userspace to create workarounds[0].
>
>Fix this by increasing the message size if dumping the filter chain into
>the allocated skb fails. Use the size of the incoming skb as a size hint
>if set, so we can start at a larger value when appropriate.
>
>To trigger this, run the following commands:
>
> # ip link add type veth
> # tc qdisc replace dev veth0 root handle 1: fq_codel
> # tc -echo filter add dev veth0 parent 1: u32 match u32 0 0 $(for i in $(seq 32); do echo action pedit munge ip dport set 22; done)
>
>Before this fix, tc just returns:
>
>Not a filter(cmd 2)
>
>After the fix, we get the correct echo:
>
>added filter dev veth0 parent 1: protocol all pref 49152 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 terminal flowid not_in_hw
>  match 00000000/00000000 at 0
>	action order 1:  pedit action pass keys 1
> 	index 1 ref 1 bind 1
>	key #0  at 20: val 00000016 mask ffff0000
>[repeated 32 times]
>
>[0] https://github.com/openvswitch/ovs/commit/106ef21860c935e5e0017a88bf42b94025c4e511
>
>Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
>Reported-by: Frode Nordahl <frode.nordahl@...onical.com>
>Closes: https://bugs.launchpad.net/ubuntu/+source/openvswitch/+bug/2018500
>Signed-off-by: Toke Høiland-Jørgensen <toke@...hat.com>

Reviewed-by: Jiri Pirko <jiri@...dia.com>