netdev - Re: [PATCH v2 net-next] net: dsa: validate source trunk against lags

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250731114414.2ofpam6rt3krmjp4@skbuf>
Date: Thu, 31 Jul 2025 14:44:14 +0300
From: Vladimir Oltean <olteanv@...il.com>
To: Luke Howard <lukeh@...l.com>
Cc: netdev@...r.kernel.org, Andrew Lunn <andrew@...n.ch>,
	Ryan Wilkins <Ryan.Wilkins@...osalliance.com>
Subject: Re: [PATCH v2 net-next] net: dsa: validate source trunk against
 lags_len

On Thu, Jul 31, 2025 at 07:56:37PM +1000, Luke Howard wrote:
> A DSA frame with an invalid source trunk ID could cause an out-of-bounds
> read access of dst->lags.
> 
> Add a check to dsa_lag_by_id() to validate the LAG ID is not zero, and is
> less than or equal to dst->lags_len. (The LAG ID is derived by adding one
> to the source trunk ID.)
> 
> Note: this is in the fast path for any frames within a trunk.
> 
> Fixes: 5b60dadb71db ("net: dsa: tag_dsa: Support reception of packets from LAG devices")
> Signed-off-by: Luke Howard <lukeh@...l.com>
> ---

1. You need to carry over previous review tags (like from Dawid Osuchowski)
when you send new patch versions.

2. As mentioned in the comments to the previous change, you can submit
patches with a Fixes tag to 'net-next' only if the fixed commit is
exclusively present in net-next. Not the case here.

3. The discussion on v1 is still ongoing, you shouldn't have posted v2
within one minute of replying to the v1 comments. Further changes will
have to be made at least to the commit message of this patch, let's
discuss them back on v1 after we have more data.

pw-bot: changes-requested