netdev - Re: [PATCH net-next] sock: Correct error checking condition for assign|release_proto

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89iKP-5hy-oMuYwEvwFOzzAkfF5=8v7patSE5z7PZQS0V2Q@mail.gmail.com>
Date: Tue, 8 Apr 2025 21:06:55 +0200
From: Eric Dumazet <edumazet@...gle.com>
To: Zijun Hu <zijun_hu@...oud.com>
Cc: Kuniyuki Iwashima <kuniyu@...zon.com>, Paolo Abeni <pabeni@...hat.com>, 
	Willem de Bruijn <willemb@...gle.com>, "David S. Miller" <davem@...emloft.net>, 
	Jakub Kicinski <kuba@...nel.org>, Simon Horman <horms@...nel.org>, Pavel Emelyanov <xemul@...nvz.org>, 
	Eric Dumazet <dada1@...mosbay.com>, netdev@...r.kernel.org, linux-kernel@...r.kernel.org, 
	Zijun Hu <quic_zijuhu@...cinc.com>
Subject: Re: [PATCH net-next] sock: Correct error checking condition for assign|release_proto_idx()

On Tue, Apr 8, 2025 at 3:43 PM Zijun Hu <zijun_hu@...oud.com> wrote:
>
> From: Zijun Hu <quic_zijuhu@...cinc.com>
>
> assign|release_proto_idx() wrongly check find_first_zero_bit() failure
> by condition '(prot->inuse_idx == PROTO_INUSE_NR - 1)' obviously.
>
> Fix by correcting the condition to '(prot->inuse_idx == PROTO_INUSE_NR)'
> Also check @->inuse_idx before accessing @->val[] to avoid OOB.
>
> Fixes: 13ff3d6fa4e6 ("[SOCK]: Enumerate struct proto-s to facilitate percpu inuse accounting (v2).")
> Signed-off-by: Zijun Hu <quic_zijuhu@...cinc.com>
> ---
>  include/net/sock.h | 5 ++++-
>  net/core/sock.c    | 7 +++++--
>  2 files changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/include/net/sock.h b/include/net/sock.h
> index 8daf1b3b12c607d81920682139b53fee935c9bb5..9ece93a3dd044997276b0fa37dddc7b5bbdacc43 100644
> --- a/include/net/sock.h
> +++ b/include/net/sock.h
> @@ -1421,7 +1421,10 @@ struct prot_inuse {
>  static inline void sock_prot_inuse_add(const struct net *net,
>                                        const struct proto *prot, int val)
>  {
> -       this_cpu_add(net->core.prot_inuse->val[prot->inuse_idx], val);
> +       unsigned int idx = prot->inuse_idx;
> +
> +       if (likely(idx < PROTO_INUSE_NR))
> +               this_cpu_add(net->core.prot_inuse->val[idx], val);
>  }

I do not think we are going to add such a test in the fast path, for a
bug that can not happen.

Please give us a reproducer ?