* [PATCH net] vxlan: check tun_info options_len properly
@ 2019-10-28 17:24 Xin Long
2019-10-30 0:40 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Xin Long @ 2019-10-28 17:24 UTC (permalink / raw)
To: network dev; +Cc: davem, Thomas Graf
This patch is to improve the tun_info options_len by dropping
the skb when TUNNEL_VXLAN_OPT is set but options_len is less
than vxlan_metadata. This can void a potential out-of-bounds
access on ip_tun_info.
Fixes: ee122c79d422 ("vxlan: Flow based tunneling")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
---
drivers/net/vxlan.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index fcf0282..ac5c597 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2487,9 +2487,11 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
vni = tunnel_id_to_key32(info->key.tun_id);
ifindex = 0;
dst_cache = &info->dst_cache;
- if (info->options_len &&
- info->key.tun_flags & TUNNEL_VXLAN_OPT)
+ if (info->key.tun_flags & TUNNEL_VXLAN_OPT) {
+ if (info->options_len < sizeof(*md))
+ goto drop;
md = ip_tunnel_info_opts(info);
+ }
ttl = info->key.ttl;
tos = info->key.tos;
label = info->key.label;
--
2.1.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net] vxlan: check tun_info options_len properly
2019-10-28 17:24 [PATCH net] vxlan: check tun_info options_len properly Xin Long
@ 2019-10-30 0:40 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2019-10-30 0:40 UTC (permalink / raw)
To: lucien.xin; +Cc: netdev, tgraf
From: Xin Long <lucien.xin@gmail.com>
Date: Tue, 29 Oct 2019 01:24:32 +0800
> This patch is to improve the tun_info options_len by dropping
> the skb when TUNNEL_VXLAN_OPT is set but options_len is less
> than vxlan_metadata. This can void a potential out-of-bounds
> access on ip_tun_info.
>
> Fixes: ee122c79d422 ("vxlan: Flow based tunneling")
> Signed-off-by: Xin Long <lucien.xin@gmail.com>
Applied and queued up for -stable, thanks Xin.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-10-30 0:40 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-10-28 17:24 [PATCH net] vxlan: check tun_info options_len properly Xin Long
2019-10-30 0:40 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.