netdev - Re: [PATCH v2 net-next] net: dsa: validate source trunk against lags

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ffba7b2f-ad0d-4855-83ae-a3e4f0de766f@lunn.ch>
Date: Thu, 31 Jul 2025 15:07:02 +0200
From: Andrew Lunn <andrew@...n.ch>
To: Luke Howard <lukeh@...l.com>
Cc: netdev@...r.kernel.org, Vladimir Oltean <olteanv@...il.com>,
	Ryan Wilkins <Ryan.Wilkins@...osalliance.com>
Subject: Re: [PATCH v2 net-next] net: dsa: validate source trunk against
 lags_len

On Thu, Jul 31, 2025 at 07:56:37PM +1000, Luke Howard wrote:
> A DSA frame with an invalid source trunk ID could cause an out-of-bounds
> read access of dst->lags.
> 
> Add a check to dsa_lag_by_id() to validate the LAG ID is not zero, and is
> less than or equal to dst->lags_len. (The LAG ID is derived by adding one
> to the source trunk ID.)
> 
> Note: this is in the fast path for any frames within a trunk.
> 
> Fixes: 5b60dadb71db ("net: dsa: tag_dsa: Support reception of packets from LAG devices")
> Signed-off-by: Luke Howard <lukeh@...l.com>

Adding to what Vladimir said, please also have each patchset in its
own thread. There is a CI system which takes patches from the list and
tests them. It does not always understand multiple patchsets in one
thread. If the CI misses a patch, it pretty much means an automatic
rejection of the patch and you will need to resubmit.

	Andrew