netdev - Re: [PATCH net-next v8 4/7] bonding: Processing extended arp_ip

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250829131850.GK31759@horms.kernel.org>
Date: Fri, 29 Aug 2025 14:18:50 +0100
From: Simon Horman <horms@...nel.org>
To: David Wilder <wilder@...ibm.com>
Cc: netdev@...r.kernel.org, jv@...sburgh.net, pradeeps@...ux.vnet.ibm.com,
	pradeep@...ibm.com, i.maximets@....org, amorenoz@...hat.com,
	haliu@...hat.com, stephen@...workplumber.org
Subject: Re: [PATCH net-next v8 4/7] bonding: Processing extended
 arp_ip_target from user space.

On Thu, Aug 28, 2025 at 03:18:06PM -0700, David Wilder wrote:
> Changes to bond_netlink and bond_options to process extended
> format arp_ip_target option sent from user space via the ip
> command.
> 
> The extended format adds a list of vlan tags to the ip target address.
> 
> Signed-off-by: David Wilder <wilder@...ibm.com>

...

> diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c

...

> +/**
> + * bond_validate_tags - validate an array of bond_vlan_tag.
> + * @tags: the array to validate
> + * @len: the length in bytes of @tags
> + *
> + * Validate that @tags points to a valid array of struct bond_vlan_tag.
> + * Returns the length of the validated bytes in the array or -1 if no
> + * valid list is found.
> + */
> +static int bond_validate_tags(struct bond_vlan_tag *tags, size_t len)
> +{
> +	size_t i, ntags = 0;
> +
> +	if (len == 0 || !tags)
> +		return 0;
> +
> +	for (i = 0; i <= len; i = i + sizeof(struct bond_vlan_tag)) {
> +		if (ntags > BOND_MAX_VLAN_TAGS)
> +			break;

Hi David,

BOND_MAX_VLAN_TAGS is used here but it isn't defined until a subsequent
patch in this series. Which breaks bisection.

I didn't check, but probably this can be addressed by moving
the definition of BOND_MAX_VLAN_TAGS to this patch.

> +
> +		if (tags->vlan_proto == BOND_VLAN_PROTO_NONE)
> +			return i + sizeof(struct bond_vlan_tag);
> +
> +		if (tags->vlan_id > 4094)
> +			break;
> +		tags++;
> +		ntags++;
> +	}
> +	return -1;
>  }

...

-- 
pw-bot: changes-requested