* [PATCH net] bonding: prevent out of bound accesses
@ 2016-06-30 12:56 Eric Dumazet
2016-06-30 13:04 ` Dmitry Vyukov
` (2 more replies)
0 siblings, 3 replies; 12+ messages in thread
From: Eric Dumazet @ 2016-06-30 12:56 UTC (permalink / raw)
To: David Miller
Cc: netdev, Mahesh Bandewar, Nikolay Aleksandrov, Ding Tianhong,
Dmitry Vyukov
From: Eric Dumazet <edumazet@google.com>
ether_addr_equal_64bits() requires some care about its arguments,
namely that 8 bytes might be read, even if last 2 byte values are not
used.
KASan detected a violation with null_mac_addr and lacpdu_mcast_addr
in bond_3ad.c
Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare")
Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
---
drivers/net/bonding/bond_3ad.c | 11 +++++++----
drivers/net/bonding/bond_alb.c | 3 ---
include/net/bonding.h | 7 ++++++-
3 files changed, 13 insertions(+), 8 deletions(-)
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index ca81f46ea1aa..8ad491ab1d01 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -101,11 +101,14 @@ enum ad_link_speed_type {
#define MAC_ADDRESS_EQUAL(A, B) \
ether_addr_equal_64bits((const u8 *)A, (const u8 *)B)
-static struct mac_addr null_mac_addr = { { 0, 0, 0, 0, 0, 0 } };
+static const u8 null_mac_addr[ETH_ALEN] __long_aligned = {
+ 0, 0, 0, 0, 0, 0
+};
static u16 ad_ticks_per_sec;
static const int ad_delta_in_ticks = (AD_TIMER_INTERVAL * HZ) / 1000;
-static const u8 lacpdu_mcast_addr[ETH_ALEN] = MULTICAST_LACPDU_ADDR;
+static const u8 lacpdu_mcast_addr[ETH_ALEN] __long_aligned =
+ MULTICAST_LACPDU_ADDR;
/* ================= main 802.3ad protocol functions ================== */
static int ad_lacpdu_send(struct port *port);
@@ -1739,7 +1742,7 @@ static void ad_clear_agg(struct aggregator *aggregator)
aggregator->is_individual = false;
aggregator->actor_admin_aggregator_key = 0;
aggregator->actor_oper_aggregator_key = 0;
- aggregator->partner_system = null_mac_addr;
+ eth_zero_addr(aggregator->partner_system.mac_addr_value);
aggregator->partner_system_priority = 0;
aggregator->partner_oper_aggregator_key = 0;
aggregator->receive_state = 0;
@@ -1761,7 +1764,7 @@ static void ad_initialize_agg(struct aggregator *aggregator)
if (aggregator) {
ad_clear_agg(aggregator);
- aggregator->aggregator_mac_address = null_mac_addr;
+ eth_zero_addr(aggregator->aggregator_mac_address.mac_addr_value);
aggregator->aggregator_identifier = 0;
aggregator->slave = NULL;
}
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index c5ac160a8ae9..26beed070bf0 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -42,9 +42,6 @@
-#ifndef __long_aligned
-#define __long_aligned __attribute__((aligned((sizeof(long)))))
-#endif
static const u8 mac_bcast[ETH_ALEN] __long_aligned = {
0xff, 0xff, 0xff, 0xff, 0xff, 0xff
};
diff --git a/include/net/bonding.h b/include/net/bonding.h
index 791800ddd6d9..6360c259da6d 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -34,6 +34,9 @@
#define BOND_DEFAULT_MIIMON 100
+#ifndef __long_aligned
+#define __long_aligned __attribute__((aligned((sizeof(long)))))
+#endif
/*
* Less bad way to call ioctl from within the kernel; this needs to be
* done some other way to get the call out of interrupt context.
@@ -138,7 +141,9 @@ struct bond_params {
struct reciprocal_value reciprocal_packets_per_slave;
u16 ad_actor_sys_prio;
u16 ad_user_port_key;
- u8 ad_actor_system[ETH_ALEN];
+
+ /* 2 bytes of padding : see ether_addr_equal_64bits() */
+ u8 ad_actor_system[ETH_ALEN + 2];
};
struct bond_parm_tbl {
^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [PATCH net] bonding: prevent out of bound accesses
2016-06-30 12:56 [PATCH net] bonding: prevent out of bound accesses Eric Dumazet
@ 2016-06-30 13:04 ` Dmitry Vyukov
2016-06-30 13:25 ` Eric Dumazet
2016-06-30 13:24 ` Nikolay Aleksandrov
2016-06-30 14:13 ` [PATCH v2 " Eric Dumazet
2 siblings, 1 reply; 12+ messages in thread
From: Dmitry Vyukov @ 2016-06-30 13:04 UTC (permalink / raw)
To: Eric Dumazet
Cc: David Miller, netdev, Mahesh Bandewar, Nikolay Aleksandrov,
Ding Tianhong
On Thu, Jun 30, 2016 at 2:56 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
> From: Eric Dumazet <edumazet@google.com>
>
> ether_addr_equal_64bits() requires some care about its arguments,
> namely that 8 bytes might be read, even if last 2 byte values are not
> used.
>
> KASan detected a violation with null_mac_addr and lacpdu_mcast_addr
> in bond_3ad.c
>
> Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare")
> Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reported-by: Dmitry Vyukov <dvyukov@google.com>
> ---
> drivers/net/bonding/bond_3ad.c | 11 +++++++----
> drivers/net/bonding/bond_alb.c | 3 ---
> include/net/bonding.h | 7 ++++++-
> 3 files changed, 13 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
> index ca81f46ea1aa..8ad491ab1d01 100644
> --- a/drivers/net/bonding/bond_3ad.c
> +++ b/drivers/net/bonding/bond_3ad.c
> @@ -101,11 +101,14 @@ enum ad_link_speed_type {
> #define MAC_ADDRESS_EQUAL(A, B) \
> ether_addr_equal_64bits((const u8 *)A, (const u8 *)B)
>
> -static struct mac_addr null_mac_addr = { { 0, 0, 0, 0, 0, 0 } };
> +static const u8 null_mac_addr[ETH_ALEN] __long_aligned = {
> + 0, 0, 0, 0, 0, 0
> +};
__long_aligned won't prevent KASAN from barking, it's still 6 bytes
but we are reading 8.
Can we please do "ETH_ALEN + 2" as below?
> static u16 ad_ticks_per_sec;
> static const int ad_delta_in_ticks = (AD_TIMER_INTERVAL * HZ) / 1000;
>
> -static const u8 lacpdu_mcast_addr[ETH_ALEN] = MULTICAST_LACPDU_ADDR;
> +static const u8 lacpdu_mcast_addr[ETH_ALEN] __long_aligned =
> + MULTICAST_LACPDU_ADDR;
>
> /* ================= main 802.3ad protocol functions ================== */
> static int ad_lacpdu_send(struct port *port);
> @@ -1739,7 +1742,7 @@ static void ad_clear_agg(struct aggregator *aggregator)
> aggregator->is_individual = false;
> aggregator->actor_admin_aggregator_key = 0;
> aggregator->actor_oper_aggregator_key = 0;
> - aggregator->partner_system = null_mac_addr;
> + eth_zero_addr(aggregator->partner_system.mac_addr_value);
> aggregator->partner_system_priority = 0;
> aggregator->partner_oper_aggregator_key = 0;
> aggregator->receive_state = 0;
> @@ -1761,7 +1764,7 @@ static void ad_initialize_agg(struct aggregator *aggregator)
> if (aggregator) {
> ad_clear_agg(aggregator);
>
> - aggregator->aggregator_mac_address = null_mac_addr;
> + eth_zero_addr(aggregator->aggregator_mac_address.mac_addr_value);
> aggregator->aggregator_identifier = 0;
> aggregator->slave = NULL;
> }
> diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
> index c5ac160a8ae9..26beed070bf0 100644
> --- a/drivers/net/bonding/bond_alb.c
> +++ b/drivers/net/bonding/bond_alb.c
> @@ -42,9 +42,6 @@
>
>
>
> -#ifndef __long_aligned
> -#define __long_aligned __attribute__((aligned((sizeof(long)))))
> -#endif
> static const u8 mac_bcast[ETH_ALEN] __long_aligned = {
> 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
> };
> diff --git a/include/net/bonding.h b/include/net/bonding.h
> index 791800ddd6d9..6360c259da6d 100644
> --- a/include/net/bonding.h
> +++ b/include/net/bonding.h
> @@ -34,6 +34,9 @@
>
> #define BOND_DEFAULT_MIIMON 100
>
> +#ifndef __long_aligned
> +#define __long_aligned __attribute__((aligned((sizeof(long)))))
> +#endif
> /*
> * Less bad way to call ioctl from within the kernel; this needs to be
> * done some other way to get the call out of interrupt context.
> @@ -138,7 +141,9 @@ struct bond_params {
> struct reciprocal_value reciprocal_packets_per_slave;
> u16 ad_actor_sys_prio;
> u16 ad_user_port_key;
> - u8 ad_actor_system[ETH_ALEN];
> +
> + /* 2 bytes of padding : see ether_addr_equal_64bits() */
> + u8 ad_actor_system[ETH_ALEN + 2];
> };
>
> struct bond_parm_tbl {
>
>
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net] bonding: prevent out of bound accesses
2016-06-30 12:56 [PATCH net] bonding: prevent out of bound accesses Eric Dumazet
2016-06-30 13:04 ` Dmitry Vyukov
@ 2016-06-30 13:24 ` Nikolay Aleksandrov
2016-06-30 14:13 ` [PATCH v2 " Eric Dumazet
2 siblings, 0 replies; 12+ messages in thread
From: Nikolay Aleksandrov @ 2016-06-30 13:24 UTC (permalink / raw)
To: Eric Dumazet, David Miller
Cc: netdev, Mahesh Bandewar, Nikolay Aleksandrov, Ding Tianhong,
Dmitry Vyukov
On 30/06/16 14:56, Eric Dumazet wrote:
> From: Eric Dumazet <edumazet@google.com>
>
> ether_addr_equal_64bits() requires some care about its arguments,
> namely that 8 bytes might be read, even if last 2 byte values are not
> used.
>
> KASan detected a violation with null_mac_addr and lacpdu_mcast_addr
> in bond_3ad.c
>
> Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare")
> Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reported-by: Dmitry Vyukov <dvyukov@google.com>
> ---
> drivers/net/bonding/bond_3ad.c | 11 +++++++----
> drivers/net/bonding/bond_alb.c | 3 ---
> include/net/bonding.h | 7 ++++++-
> 3 files changed, 13 insertions(+), 8 deletions(-)
>
Good catch,
Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net] bonding: prevent out of bound accesses
2016-06-30 13:04 ` Dmitry Vyukov
@ 2016-06-30 13:25 ` Eric Dumazet
2016-06-30 13:35 ` Dmitry Vyukov
0 siblings, 1 reply; 12+ messages in thread
From: Eric Dumazet @ 2016-06-30 13:25 UTC (permalink / raw)
To: Dmitry Vyukov
Cc: David Miller, netdev, Mahesh Bandewar, Nikolay Aleksandrov,
Ding Tianhong
On Thu, 2016-06-30 at 15:04 +0200, Dmitry Vyukov wrote:
> On Thu, Jun 30, 2016 at 2:56 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
> > From: Eric Dumazet <edumazet@google.com>
> >
> > ether_addr_equal_64bits() requires some care about its arguments,
> > namely that 8 bytes might be read, even if last 2 byte values are not
> > used.
> >
> > KASan detected a violation with null_mac_addr and lacpdu_mcast_addr
> > in bond_3ad.c
> >
> > Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare")
> > Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr")
> > Signed-off-by: Eric Dumazet <edumazet@google.com>
> > Reported-by: Dmitry Vyukov <dvyukov@google.com>
> > ---
> > drivers/net/bonding/bond_3ad.c | 11 +++++++----
> > drivers/net/bonding/bond_alb.c | 3 ---
> > include/net/bonding.h | 7 ++++++-
> > 3 files changed, 13 insertions(+), 8 deletions(-)
> >
> > diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
> > index ca81f46ea1aa..8ad491ab1d01 100644
> > --- a/drivers/net/bonding/bond_3ad.c
> > +++ b/drivers/net/bonding/bond_3ad.c
> > @@ -101,11 +101,14 @@ enum ad_link_speed_type {
> > #define MAC_ADDRESS_EQUAL(A, B) \
> > ether_addr_equal_64bits((const u8 *)A, (const u8 *)B)
> >
> > -static struct mac_addr null_mac_addr = { { 0, 0, 0, 0, 0, 0 } };
> > +static const u8 null_mac_addr[ETH_ALEN] __long_aligned = {
> > + 0, 0, 0, 0, 0, 0
> > +};
>
> __long_aligned won't prevent KASAN from barking, it's still 6 bytes
> but we are reading 8.
> Can we please do "ETH_ALEN + 2" as below?
Really ?
sizeof(null_mac_addr) is 8, how KASan would decide it is 6 bytes ?
nm -v drivers/net/bonding/bonding.ko|grep -3 null_mac_addr
000000000000084a r __UNIQUE_ID_mode17
0000000000000850 r tmpl.46263
0000000000000860 r lacpdu_mcast_addr
0000000000000868 r null_mac_addr
0000000000000870 r mac_v6_allmcast
0000000000000878 r mac_bcast
0000000000000880 r slave_sysfs_ops
Same trick was used in
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=885a136c52a8871175477baf3903e1c38751b35a
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net] bonding: prevent out of bound accesses
2016-06-30 13:25 ` Eric Dumazet
@ 2016-06-30 13:35 ` Dmitry Vyukov
2016-06-30 14:08 ` Eric Dumazet
0 siblings, 1 reply; 12+ messages in thread
From: Dmitry Vyukov @ 2016-06-30 13:35 UTC (permalink / raw)
To: Eric Dumazet
Cc: David Miller, netdev, Mahesh Bandewar, Nikolay Aleksandrov,
Ding Tianhong
On Thu, Jun 30, 2016 at 3:25 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
> On Thu, 2016-06-30 at 15:04 +0200, Dmitry Vyukov wrote:
>> On Thu, Jun 30, 2016 at 2:56 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
>> > From: Eric Dumazet <edumazet@google.com>
>> >
>> > ether_addr_equal_64bits() requires some care about its arguments,
>> > namely that 8 bytes might be read, even if last 2 byte values are not
>> > used.
>> >
>> > KASan detected a violation with null_mac_addr and lacpdu_mcast_addr
>> > in bond_3ad.c
>> >
>> > Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare")
>> > Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr")
>> > Signed-off-by: Eric Dumazet <edumazet@google.com>
>> > Reported-by: Dmitry Vyukov <dvyukov@google.com>
>> > ---
>> > drivers/net/bonding/bond_3ad.c | 11 +++++++----
>> > drivers/net/bonding/bond_alb.c | 3 ---
>> > include/net/bonding.h | 7 ++++++-
>> > 3 files changed, 13 insertions(+), 8 deletions(-)
>> >
>> > diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
>> > index ca81f46ea1aa..8ad491ab1d01 100644
>> > --- a/drivers/net/bonding/bond_3ad.c
>> > +++ b/drivers/net/bonding/bond_3ad.c
>> > @@ -101,11 +101,14 @@ enum ad_link_speed_type {
>> > #define MAC_ADDRESS_EQUAL(A, B) \
>> > ether_addr_equal_64bits((const u8 *)A, (const u8 *)B)
>> >
>> > -static struct mac_addr null_mac_addr = { { 0, 0, 0, 0, 0, 0 } };
>> > +static const u8 null_mac_addr[ETH_ALEN] __long_aligned = {
>> > + 0, 0, 0, 0, 0, 0
>> > +};
>>
>> __long_aligned won't prevent KASAN from barking, it's still 6 bytes
>> but we are reading 8.
>> Can we please do "ETH_ALEN + 2" as below?
>
> Really ?
>
> sizeof(null_mac_addr) is 8, how KASan would decide it is 6 bytes ?
>
> nm -v drivers/net/bonding/bonding.ko|grep -3 null_mac_addr
>
> 000000000000084a r __UNIQUE_ID_mode17
> 0000000000000850 r tmpl.46263
> 0000000000000860 r lacpdu_mcast_addr
> 0000000000000868 r null_mac_addr
> 0000000000000870 r mac_v6_allmcast
> 0000000000000878 r mac_bcast
> 0000000000000880 r slave_sysfs_ops
What does nm -S say?
I've tried to compile a sample program with gcc6 and
__attribute__((aligned(8))) does in fact force alignment of start of
the symbol, but size still stays 6. (and asan still barks on my test
program).
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net] bonding: prevent out of bound accesses
2016-06-30 13:35 ` Dmitry Vyukov
@ 2016-06-30 14:08 ` Eric Dumazet
2016-06-30 14:13 ` Dmitry Vyukov
0 siblings, 1 reply; 12+ messages in thread
From: Eric Dumazet @ 2016-06-30 14:08 UTC (permalink / raw)
To: Dmitry Vyukov
Cc: David Miller, netdev, Mahesh Bandewar, Nikolay Aleksandrov,
Ding Tianhong
On Thu, 2016-06-30 at 15:35 +0200, Dmitry Vyukov wrote:
>
> What does nm -S say?
> I've tried to compile a sample program with gcc6 and
> __attribute__((aligned(8))) does in fact force alignment of start of
> the symbol, but size still stays 6. (and asan still barks on my test
> program).
Right, but then it means I also need to change mac_bcast[] and
mac_v6_allmcast[] in bond_alb.c to avoid false positive.
(Technically, if their alignment is 8, we have 8 bytes there,
no way it could span 2 pages)
I'll send a v2.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net] bonding: prevent out of bound accesses
2016-06-30 14:08 ` Eric Dumazet
@ 2016-06-30 14:13 ` Dmitry Vyukov
0 siblings, 0 replies; 12+ messages in thread
From: Dmitry Vyukov @ 2016-06-30 14:13 UTC (permalink / raw)
To: Eric Dumazet
Cc: David Miller, netdev, Mahesh Bandewar, Nikolay Aleksandrov,
Ding Tianhong
On Thu, Jun 30, 2016 at 4:08 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
> On Thu, 2016-06-30 at 15:35 +0200, Dmitry Vyukov wrote:
>
>>
>> What does nm -S say?
>> I've tried to compile a sample program with gcc6 and
>> __attribute__((aligned(8))) does in fact force alignment of start of
>> the symbol, but size still stays 6. (and asan still barks on my test
>> program).
>
> Right, but then it means I also need to change mac_bcast[] and
> mac_v6_allmcast[] in bond_alb.c to avoid false positive.
>
> (Technically, if their alignment is 8, we have 8 bytes there,
> no way it could span 2 pages)
Agree.
> I'll send a v2.
Thanks!
^ permalink raw reply [flat|nested] 12+ messages in thread
* [PATCH v2 net] bonding: prevent out of bound accesses
2016-06-30 12:56 [PATCH net] bonding: prevent out of bound accesses Eric Dumazet
2016-06-30 13:04 ` Dmitry Vyukov
2016-06-30 13:24 ` Nikolay Aleksandrov
@ 2016-06-30 14:13 ` Eric Dumazet
2016-06-30 14:19 ` Dmitry Vyukov
` (3 more replies)
2 siblings, 4 replies; 12+ messages in thread
From: Eric Dumazet @ 2016-06-30 14:13 UTC (permalink / raw)
To: David Miller
Cc: netdev, Mahesh Bandewar, Nikolay Aleksandrov, Ding Tianhong,
Dmitry Vyukov
From: Eric Dumazet <edumazet@google.com>
ether_addr_equal_64bits() requires some care about its arguments,
namely that 8 bytes might be read, even if last 2 byte values are not
used.
KASan detected a violation with null_mac_addr and lacpdu_mcast_addr
in bond_3ad.c
Same problem with mac_bcast[] and mac_v6_allmcast[] in bond_alb.c :
Although the 8-byte alignment was there, KASan would detect out
of bound accesses.
Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare")
Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr")
Fixes: 885a136c52a8 ("bonding: use compare_ether_addr_64bits() in ALB")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
---
drivers/net/bonding/bond_3ad.c | 11 +++++++----
drivers/net/bonding/bond_alb.c | 7 ++-----
include/net/bonding.h | 7 ++++++-
3 files changed, 15 insertions(+), 10 deletions(-)
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index ca81f46ea1aa..8ad491ab1d01 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -101,11 +101,14 @@ enum ad_link_speed_type {
#define MAC_ADDRESS_EQUAL(A, B) \
ether_addr_equal_64bits((const u8 *)A, (const u8 *)B)
-static struct mac_addr null_mac_addr = { { 0, 0, 0, 0, 0, 0 } };
+static const u8 null_mac_addr[ETH_ALEN + 2] __long_aligned = {
+ 0, 0, 0, 0, 0, 0
+};
static u16 ad_ticks_per_sec;
static const int ad_delta_in_ticks = (AD_TIMER_INTERVAL * HZ) / 1000;
-static const u8 lacpdu_mcast_addr[ETH_ALEN] = MULTICAST_LACPDU_ADDR;
+static const u8 lacpdu_mcast_addr[ETH_ALEN + 2] __long_aligned =
+ MULTICAST_LACPDU_ADDR;
/* ================= main 802.3ad protocol functions ================== */
static int ad_lacpdu_send(struct port *port);
@@ -1739,7 +1742,7 @@ static void ad_clear_agg(struct aggregator *aggregator)
aggregator->is_individual = false;
aggregator->actor_admin_aggregator_key = 0;
aggregator->actor_oper_aggregator_key = 0;
- aggregator->partner_system = null_mac_addr;
+ eth_zero_addr(aggregator->partner_system.mac_addr_value);
aggregator->partner_system_priority = 0;
aggregator->partner_oper_aggregator_key = 0;
aggregator->receive_state = 0;
@@ -1761,7 +1764,7 @@ static void ad_initialize_agg(struct aggregator *aggregator)
if (aggregator) {
ad_clear_agg(aggregator);
- aggregator->aggregator_mac_address = null_mac_addr;
+ eth_zero_addr(aggregator->aggregator_mac_address.mac_addr_value);
aggregator->aggregator_identifier = 0;
aggregator->slave = NULL;
}
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index c5ac160a8ae9..551f0f8dead3 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -42,13 +42,10 @@
-#ifndef __long_aligned
-#define __long_aligned __attribute__((aligned((sizeof(long)))))
-#endif
-static const u8 mac_bcast[ETH_ALEN] __long_aligned = {
+static const u8 mac_bcast[ETH_ALEN + 2] __long_aligned = {
0xff, 0xff, 0xff, 0xff, 0xff, 0xff
};
-static const u8 mac_v6_allmcast[ETH_ALEN] __long_aligned = {
+static const u8 mac_v6_allmcast[ETH_ALEN + 2] __long_aligned = {
0x33, 0x33, 0x00, 0x00, 0x00, 0x01
};
static const int alb_delta_in_ticks = HZ / ALB_TIMER_TICKS_PER_SEC;
diff --git a/include/net/bonding.h b/include/net/bonding.h
index 791800ddd6d9..6360c259da6d 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -34,6 +34,9 @@
#define BOND_DEFAULT_MIIMON 100
+#ifndef __long_aligned
+#define __long_aligned __attribute__((aligned((sizeof(long)))))
+#endif
/*
* Less bad way to call ioctl from within the kernel; this needs to be
* done some other way to get the call out of interrupt context.
@@ -138,7 +141,9 @@ struct bond_params {
struct reciprocal_value reciprocal_packets_per_slave;
u16 ad_actor_sys_prio;
u16 ad_user_port_key;
- u8 ad_actor_system[ETH_ALEN];
+
+ /* 2 bytes of padding : see ether_addr_equal_64bits() */
+ u8 ad_actor_system[ETH_ALEN + 2];
};
struct bond_parm_tbl {
^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [PATCH v2 net] bonding: prevent out of bound accesses
2016-06-30 14:13 ` [PATCH v2 " Eric Dumazet
@ 2016-06-30 14:19 ` Dmitry Vyukov
2016-06-30 14:43 ` Nikolay Aleksandrov
` (2 subsequent siblings)
3 siblings, 0 replies; 12+ messages in thread
From: Dmitry Vyukov @ 2016-06-30 14:19 UTC (permalink / raw)
To: Eric Dumazet
Cc: David Miller, netdev, Mahesh Bandewar, Nikolay Aleksandrov,
Ding Tianhong
On Thu, Jun 30, 2016 at 4:13 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
> From: Eric Dumazet <edumazet@google.com>
>
> ether_addr_equal_64bits() requires some care about its arguments,
> namely that 8 bytes might be read, even if last 2 byte values are not
> used.
>
> KASan detected a violation with null_mac_addr and lacpdu_mcast_addr
> in bond_3ad.c
>
> Same problem with mac_bcast[] and mac_v6_allmcast[] in bond_alb.c :
> Although the 8-byte alignment was there, KASan would detect out
> of bound accesses.
>
> Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare")
> Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr")
> Fixes: 885a136c52a8 ("bonding: use compare_ether_addr_64bits() in ALB")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reported-by: Dmitry Vyukov <dvyukov@google.com>
> ---
> drivers/net/bonding/bond_3ad.c | 11 +++++++----
> drivers/net/bonding/bond_alb.c | 7 ++-----
> include/net/bonding.h | 7 ++++++-
> 3 files changed, 15 insertions(+), 10 deletions(-)
>
> diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
> index ca81f46ea1aa..8ad491ab1d01 100644
> --- a/drivers/net/bonding/bond_3ad.c
> +++ b/drivers/net/bonding/bond_3ad.c
> @@ -101,11 +101,14 @@ enum ad_link_speed_type {
> #define MAC_ADDRESS_EQUAL(A, B) \
> ether_addr_equal_64bits((const u8 *)A, (const u8 *)B)
>
> -static struct mac_addr null_mac_addr = { { 0, 0, 0, 0, 0, 0 } };
> +static const u8 null_mac_addr[ETH_ALEN + 2] __long_aligned = {
> + 0, 0, 0, 0, 0, 0
> +};
> static u16 ad_ticks_per_sec;
> static const int ad_delta_in_ticks = (AD_TIMER_INTERVAL * HZ) / 1000;
>
> -static const u8 lacpdu_mcast_addr[ETH_ALEN] = MULTICAST_LACPDU_ADDR;
> +static const u8 lacpdu_mcast_addr[ETH_ALEN + 2] __long_aligned =
> + MULTICAST_LACPDU_ADDR;
>
> /* ================= main 802.3ad protocol functions ================== */
> static int ad_lacpdu_send(struct port *port);
> @@ -1739,7 +1742,7 @@ static void ad_clear_agg(struct aggregator *aggregator)
> aggregator->is_individual = false;
> aggregator->actor_admin_aggregator_key = 0;
> aggregator->actor_oper_aggregator_key = 0;
> - aggregator->partner_system = null_mac_addr;
> + eth_zero_addr(aggregator->partner_system.mac_addr_value);
> aggregator->partner_system_priority = 0;
> aggregator->partner_oper_aggregator_key = 0;
> aggregator->receive_state = 0;
> @@ -1761,7 +1764,7 @@ static void ad_initialize_agg(struct aggregator *aggregator)
> if (aggregator) {
> ad_clear_agg(aggregator);
>
> - aggregator->aggregator_mac_address = null_mac_addr;
> + eth_zero_addr(aggregator->aggregator_mac_address.mac_addr_value);
> aggregator->aggregator_identifier = 0;
> aggregator->slave = NULL;
> }
> diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
> index c5ac160a8ae9..551f0f8dead3 100644
> --- a/drivers/net/bonding/bond_alb.c
> +++ b/drivers/net/bonding/bond_alb.c
> @@ -42,13 +42,10 @@
>
>
>
> -#ifndef __long_aligned
> -#define __long_aligned __attribute__((aligned((sizeof(long)))))
> -#endif
> -static const u8 mac_bcast[ETH_ALEN] __long_aligned = {
> +static const u8 mac_bcast[ETH_ALEN + 2] __long_aligned = {
> 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
> };
> -static const u8 mac_v6_allmcast[ETH_ALEN] __long_aligned = {
> +static const u8 mac_v6_allmcast[ETH_ALEN + 2] __long_aligned = {
> 0x33, 0x33, 0x00, 0x00, 0x00, 0x01
> };
> static const int alb_delta_in_ticks = HZ / ALB_TIMER_TICKS_PER_SEC;
> diff --git a/include/net/bonding.h b/include/net/bonding.h
> index 791800ddd6d9..6360c259da6d 100644
> --- a/include/net/bonding.h
> +++ b/include/net/bonding.h
> @@ -34,6 +34,9 @@
>
> #define BOND_DEFAULT_MIIMON 100
>
> +#ifndef __long_aligned
> +#define __long_aligned __attribute__((aligned((sizeof(long)))))
> +#endif
> /*
> * Less bad way to call ioctl from within the kernel; this needs to be
> * done some other way to get the call out of interrupt context.
> @@ -138,7 +141,9 @@ struct bond_params {
> struct reciprocal_value reciprocal_packets_per_slave;
> u16 ad_actor_sys_prio;
> u16 ad_user_port_key;
> - u8 ad_actor_system[ETH_ALEN];
> +
> + /* 2 bytes of padding : see ether_addr_equal_64bits() */
> + u8 ad_actor_system[ETH_ALEN + 2];
> };
>
> struct bond_parm_tbl {
Acked-by: Dmitry Vyukov <dvyukov@google.com>
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH v2 net] bonding: prevent out of bound accesses
2016-06-30 14:13 ` [PATCH v2 " Eric Dumazet
2016-06-30 14:19 ` Dmitry Vyukov
@ 2016-06-30 14:43 ` Nikolay Aleksandrov
2016-07-01 1:09 ` Ding Tianhong
2016-07-01 10:06 ` David Miller
3 siblings, 0 replies; 12+ messages in thread
From: Nikolay Aleksandrov @ 2016-06-30 14:43 UTC (permalink / raw)
To: Eric Dumazet, David Miller
Cc: netdev, Mahesh Bandewar, Nikolay Aleksandrov, Ding Tianhong,
Dmitry Vyukov, Jay Vosburgh, Veaceslav Falico, Andy Gospodarek
On 30/06/16 16:13, Eric Dumazet wrote:
> From: Eric Dumazet <edumazet@google.com>
>
> ether_addr_equal_64bits() requires some care about its arguments,
> namely that 8 bytes might be read, even if last 2 byte values are not
> used.
>
> KASan detected a violation with null_mac_addr and lacpdu_mcast_addr
> in bond_3ad.c
>
> Same problem with mac_bcast[] and mac_v6_allmcast[] in bond_alb.c :
> Although the 8-byte alignment was there, KASan would detect out
> of bound accesses.
>
> Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare")
> Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr")
> Fixes: 885a136c52a8 ("bonding: use compare_ether_addr_64bits() in ALB")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reported-by: Dmitry Vyukov <dvyukov@google.com>
> ---
> drivers/net/bonding/bond_3ad.c | 11 +++++++----
> drivers/net/bonding/bond_alb.c | 7 ++-----
> include/net/bonding.h | 7 ++++++-
> 3 files changed, 15 insertions(+), 10 deletions(-)
>
+CC bonding maintainers
For v2,
Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH v2 net] bonding: prevent out of bound accesses
2016-06-30 14:13 ` [PATCH v2 " Eric Dumazet
2016-06-30 14:19 ` Dmitry Vyukov
2016-06-30 14:43 ` Nikolay Aleksandrov
@ 2016-07-01 1:09 ` Ding Tianhong
2016-07-01 10:06 ` David Miller
3 siblings, 0 replies; 12+ messages in thread
From: Ding Tianhong @ 2016-07-01 1:09 UTC (permalink / raw)
To: Eric Dumazet, David Miller
Cc: netdev, Mahesh Bandewar, Nikolay Aleksandrov, Dmitry Vyukov
On 2016/6/30 22:13, Eric Dumazet wrote:
> From: Eric Dumazet <edumazet@google.com>
>
> ether_addr_equal_64bits() requires some care about its arguments,
> namely that 8 bytes might be read, even if last 2 byte values are not
> used.
>
> KASan detected a violation with null_mac_addr and lacpdu_mcast_addr
> in bond_3ad.c
>
> Same problem with mac_bcast[] and mac_v6_allmcast[] in bond_alb.c :
> Although the 8-byte alignment was there, KASan would detect out
> of bound accesses.
>
> Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare")
> Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr")
> Fixes: 885a136c52a8 ("bonding: use compare_ether_addr_64bits() in ALB")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reported-by: Dmitry Vyukov <dvyukov@google.com>
> ---
> drivers/net/bonding/bond_3ad.c | 11 +++++++----
> drivers/net/bonding/bond_alb.c | 7 ++-----
> include/net/bonding.h | 7 ++++++-
> 3 files changed, 15 insertions(+), 10 deletions(-)
>
> diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
> index ca81f46ea1aa..8ad491ab1d01 100644
> --- a/drivers/net/bonding/bond_3ad.c
> +++ b/drivers/net/bonding/bond_3ad.c
> @@ -101,11 +101,14 @@ enum ad_link_speed_type {
> #define MAC_ADDRESS_EQUAL(A, B) \
> ether_addr_equal_64bits((const u8 *)A, (const u8 *)B)
>
> -static struct mac_addr null_mac_addr = { { 0, 0, 0, 0, 0, 0 } };
> +static const u8 null_mac_addr[ETH_ALEN + 2] __long_aligned = {
> + 0, 0, 0, 0, 0, 0
> +};
> static u16 ad_ticks_per_sec;
> static const int ad_delta_in_ticks = (AD_TIMER_INTERVAL * HZ) / 1000;
>
> -static const u8 lacpdu_mcast_addr[ETH_ALEN] = MULTICAST_LACPDU_ADDR;
> +static const u8 lacpdu_mcast_addr[ETH_ALEN + 2] __long_aligned =
> + MULTICAST_LACPDU_ADDR;
>
> /* ================= main 802.3ad protocol functions ================== */
> static int ad_lacpdu_send(struct port *port);
> @@ -1739,7 +1742,7 @@ static void ad_clear_agg(struct aggregator *aggregator)
> aggregator->is_individual = false;
> aggregator->actor_admin_aggregator_key = 0;
> aggregator->actor_oper_aggregator_key = 0;
> - aggregator->partner_system = null_mac_addr;
> + eth_zero_addr(aggregator->partner_system.mac_addr_value);
> aggregator->partner_system_priority = 0;
> aggregator->partner_oper_aggregator_key = 0;
> aggregator->receive_state = 0;
> @@ -1761,7 +1764,7 @@ static void ad_initialize_agg(struct aggregator *aggregator)
> if (aggregator) {
> ad_clear_agg(aggregator);
>
> - aggregator->aggregator_mac_address = null_mac_addr;
> + eth_zero_addr(aggregator->aggregator_mac_address.mac_addr_value);
> aggregator->aggregator_identifier = 0;
> aggregator->slave = NULL;
> }
> diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
> index c5ac160a8ae9..551f0f8dead3 100644
> --- a/drivers/net/bonding/bond_alb.c
> +++ b/drivers/net/bonding/bond_alb.c
> @@ -42,13 +42,10 @@
>
>
>
> -#ifndef __long_aligned
> -#define __long_aligned __attribute__((aligned((sizeof(long)))))
> -#endif
> -static const u8 mac_bcast[ETH_ALEN] __long_aligned = {
> +static const u8 mac_bcast[ETH_ALEN + 2] __long_aligned = {
> 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
> };
> -static const u8 mac_v6_allmcast[ETH_ALEN] __long_aligned = {
> +static const u8 mac_v6_allmcast[ETH_ALEN + 2] __long_aligned = {
> 0x33, 0x33, 0x00, 0x00, 0x00, 0x01
> };
> static const int alb_delta_in_ticks = HZ / ALB_TIMER_TICKS_PER_SEC;
> diff --git a/include/net/bonding.h b/include/net/bonding.h
> index 791800ddd6d9..6360c259da6d 100644
> --- a/include/net/bonding.h
> +++ b/include/net/bonding.h
> @@ -34,6 +34,9 @@
>
> #define BOND_DEFAULT_MIIMON 100
>
> +#ifndef __long_aligned
> +#define __long_aligned __attribute__((aligned((sizeof(long)))))
> +#endif
> /*
> * Less bad way to call ioctl from within the kernel; this needs to be
> * done some other way to get the call out of interrupt context.
> @@ -138,7 +141,9 @@ struct bond_params {
> struct reciprocal_value reciprocal_packets_per_slave;
> u16 ad_actor_sys_prio;
> u16 ad_user_port_key;
> - u8 ad_actor_system[ETH_ALEN];
> +
> + /* 2 bytes of padding : see ether_addr_equal_64bits() */
> + u8 ad_actor_system[ETH_ALEN + 2];
> };
>
> struct bond_parm_tbl {
>
>
>
> .
It is fine to me.
Acked-by: Ding Tianhong <dingtianhong@huawei.com>
>
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH v2 net] bonding: prevent out of bound accesses
2016-06-30 14:13 ` [PATCH v2 " Eric Dumazet
` (2 preceding siblings ...)
2016-07-01 1:09 ` Ding Tianhong
@ 2016-07-01 10:06 ` David Miller
3 siblings, 0 replies; 12+ messages in thread
From: David Miller @ 2016-07-01 10:06 UTC (permalink / raw)
To: eric.dumazet; +Cc: netdev, maheshb, nikolay, dingtianhong, dvyukov
From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Thu, 30 Jun 2016 16:13:41 +0200
> From: Eric Dumazet <edumazet@google.com>
>
> ether_addr_equal_64bits() requires some care about its arguments,
> namely that 8 bytes might be read, even if last 2 byte values are not
> used.
>
> KASan detected a violation with null_mac_addr and lacpdu_mcast_addr
> in bond_3ad.c
>
> Same problem with mac_bcast[] and mac_v6_allmcast[] in bond_alb.c :
> Although the 8-byte alignment was there, KASan would detect out
> of bound accesses.
>
> Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare")
> Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr")
> Fixes: 885a136c52a8 ("bonding: use compare_ether_addr_64bits() in ALB")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reported-by: Dmitry Vyukov <dvyukov@google.com>
Applied, thanks Eric.
^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2016-07-01 10:07 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-06-30 12:56 [PATCH net] bonding: prevent out of bound accesses Eric Dumazet
2016-06-30 13:04 ` Dmitry Vyukov
2016-06-30 13:25 ` Eric Dumazet
2016-06-30 13:35 ` Dmitry Vyukov
2016-06-30 14:08 ` Eric Dumazet
2016-06-30 14:13 ` Dmitry Vyukov
2016-06-30 13:24 ` Nikolay Aleksandrov
2016-06-30 14:13 ` [PATCH v2 " Eric Dumazet
2016-06-30 14:19 ` Dmitry Vyukov
2016-06-30 14:43 ` Nikolay Aleksandrov
2016-07-01 1:09 ` Ding Tianhong
2016-07-01 10:06 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.