netdev - Re: [PATCH net] xsk: Fix overflow in descriptor validation@@

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c5a1c806-2c4c-47c5-b83a-cb83f93369b4@intel.com>
Date: Mon, 6 Oct 2025 17:19:42 +0200
From: Alexander Lobakin <aleksander.lobakin@...el.com>
To: Ilia Gavrilov <Ilia.Gavrilov@...otecs.ru>
CC: Magnus Karlsson <magnus.karlsson@...el.com>, Maciej Fijalkowski
	<maciej.fijalkowski@...el.com>, Stanislav Fomichev <sdf@...ichev.me>, "David
 S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, "Jakub
 Kicinski" <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Simon Horman
	<horms@...nel.org>, Alexei Starovoitov <ast@...nel.org>, Daniel Borkmann
	<daniel@...earbox.net>, Jesper Dangaard Brouer <hawk@...nel.org>, "John
 Fastabend" <john.fastabend@...il.com>, Song Yoong Siang
	<yoong.siang.song@...el.com>, "netdev@...r.kernel.org"
	<netdev@...r.kernel.org>, "bpf@...r.kernel.org" <bpf@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"lvc-project@...uxtesting.org" <lvc-project@...uxtesting.org>,
	"stable@...r.kernel.org" <stable@...r.kernel.org>
Subject: Re: [PATCH net] xsk: Fix overflow in descriptor validation@@

From: Ilia Gavrilov <Ilia.Gavrilov@...otecs.ru>
Date: Mon, 6 Oct 2025 08:53:17 +0000

> The desc->len value can be set up to U32_MAX. If umem tx_metadata_len

In theory. Never in practice.

> option is also set, then the value of the expression
> 'desc->len + pool->tx_metadata_len' can overflow and validation
> of the incorrect descriptor will be successfully passed.
> This can lead to a subsequent chain of arithmetic overflows
> in the xsk_build_skb() function and incorrect sk_buff allocation.
> 
> Found by InfoTeCS on behalf of Linux Verification Center
> (linuxtesting.org) with SVACE.

I think the general rule for sending fixes is that a fix must fix a real
bug which can be reproduced in real life scenarios.
Static Analysis Tools have no idea that nobody sends 4 Gb sized network
packets.

> 
> Fixes: 341ac980eab9 ("xsk: Support tx_metadata_len")
> Cc: stable@...r.kernel.org
> Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@...otecs.ru>
> ---
>  net/xdp/xsk_queue.h | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
Thanks,
Olek