* [PATCH net] bonding: prevent out of bound accesses @ 2016-06-30 12:56 Eric Dumazet 2016-06-30 13:04 ` Dmitry Vyukov ` (2 more replies) 0 siblings, 3 replies; 12+ messages in thread From: Eric Dumazet @ 2016-06-30 12:56 UTC (permalink / raw) To: David Miller Cc: netdev, Mahesh Bandewar, Nikolay Aleksandrov, Ding Tianhong, Dmitry Vyukov From: Eric Dumazet <edumazet@google.com> ether_addr_equal_64bits() requires some care about its arguments, namely that 8 bytes might be read, even if last 2 byte values are not used. KASan detected a violation with null_mac_addr and lacpdu_mcast_addr in bond_3ad.c Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare") Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Dmitry Vyukov <dvyukov@google.com> --- drivers/net/bonding/bond_3ad.c | 11 +++++++---- drivers/net/bonding/bond_alb.c | 3 --- include/net/bonding.h | 7 ++++++- 3 files changed, 13 insertions(+), 8 deletions(-) diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c index ca81f46ea1aa..8ad491ab1d01 100644 --- a/drivers/net/bonding/bond_3ad.c +++ b/drivers/net/bonding/bond_3ad.c @@ -101,11 +101,14 @@ enum ad_link_speed_type { #define MAC_ADDRESS_EQUAL(A, B) \ ether_addr_equal_64bits((const u8 *)A, (const u8 *)B) -static struct mac_addr null_mac_addr = { { 0, 0, 0, 0, 0, 0 } }; +static const u8 null_mac_addr[ETH_ALEN] __long_aligned = { + 0, 0, 0, 0, 0, 0 +}; static u16 ad_ticks_per_sec; static const int ad_delta_in_ticks = (AD_TIMER_INTERVAL * HZ) / 1000; -static const u8 lacpdu_mcast_addr[ETH_ALEN] = MULTICAST_LACPDU_ADDR; +static const u8 lacpdu_mcast_addr[ETH_ALEN] __long_aligned = + MULTICAST_LACPDU_ADDR; /* ================= main 802.3ad protocol functions ================== */ static int ad_lacpdu_send(struct port *port); @@ -1739,7 +1742,7 @@ static void ad_clear_agg(struct aggregator *aggregator) aggregator->is_individual = false; aggregator->actor_admin_aggregator_key = 0; aggregator->actor_oper_aggregator_key = 0; - aggregator->partner_system = null_mac_addr; + eth_zero_addr(aggregator->partner_system.mac_addr_value); aggregator->partner_system_priority = 0; aggregator->partner_oper_aggregator_key = 0; aggregator->receive_state = 0; @@ -1761,7 +1764,7 @@ static void ad_initialize_agg(struct aggregator *aggregator) if (aggregator) { ad_clear_agg(aggregator); - aggregator->aggregator_mac_address = null_mac_addr; + eth_zero_addr(aggregator->aggregator_mac_address.mac_addr_value); aggregator->aggregator_identifier = 0; aggregator->slave = NULL; } diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index c5ac160a8ae9..26beed070bf0 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -42,9 +42,6 @@ -#ifndef __long_aligned -#define __long_aligned __attribute__((aligned((sizeof(long))))) -#endif static const u8 mac_bcast[ETH_ALEN] __long_aligned = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; diff --git a/include/net/bonding.h b/include/net/bonding.h index 791800ddd6d9..6360c259da6d 100644 --- a/include/net/bonding.h +++ b/include/net/bonding.h @@ -34,6 +34,9 @@ #define BOND_DEFAULT_MIIMON 100 +#ifndef __long_aligned +#define __long_aligned __attribute__((aligned((sizeof(long))))) +#endif /* * Less bad way to call ioctl from within the kernel; this needs to be * done some other way to get the call out of interrupt context. @@ -138,7 +141,9 @@ struct bond_params { struct reciprocal_value reciprocal_packets_per_slave; u16 ad_actor_sys_prio; u16 ad_user_port_key; - u8 ad_actor_system[ETH_ALEN]; + + /* 2 bytes of padding : see ether_addr_equal_64bits() */ + u8 ad_actor_system[ETH_ALEN + 2]; }; struct bond_parm_tbl { ^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [PATCH net] bonding: prevent out of bound accesses 2016-06-30 12:56 [PATCH net] bonding: prevent out of bound accesses Eric Dumazet @ 2016-06-30 13:04 ` Dmitry Vyukov 2016-06-30 13:25 ` Eric Dumazet 2016-06-30 13:24 ` Nikolay Aleksandrov 2016-06-30 14:13 ` [PATCH v2 " Eric Dumazet 2 siblings, 1 reply; 12+ messages in thread From: Dmitry Vyukov @ 2016-06-30 13:04 UTC (permalink / raw) To: Eric Dumazet Cc: David Miller, netdev, Mahesh Bandewar, Nikolay Aleksandrov, Ding Tianhong On Thu, Jun 30, 2016 at 2:56 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote: > From: Eric Dumazet <edumazet@google.com> > > ether_addr_equal_64bits() requires some care about its arguments, > namely that 8 bytes might be read, even if last 2 byte values are not > used. > > KASan detected a violation with null_mac_addr and lacpdu_mcast_addr > in bond_3ad.c > > Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare") > Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr") > Signed-off-by: Eric Dumazet <edumazet@google.com> > Reported-by: Dmitry Vyukov <dvyukov@google.com> > --- > drivers/net/bonding/bond_3ad.c | 11 +++++++---- > drivers/net/bonding/bond_alb.c | 3 --- > include/net/bonding.h | 7 ++++++- > 3 files changed, 13 insertions(+), 8 deletions(-) > > diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c > index ca81f46ea1aa..8ad491ab1d01 100644 > --- a/drivers/net/bonding/bond_3ad.c > +++ b/drivers/net/bonding/bond_3ad.c > @@ -101,11 +101,14 @@ enum ad_link_speed_type { > #define MAC_ADDRESS_EQUAL(A, B) \ > ether_addr_equal_64bits((const u8 *)A, (const u8 *)B) > > -static struct mac_addr null_mac_addr = { { 0, 0, 0, 0, 0, 0 } }; > +static const u8 null_mac_addr[ETH_ALEN] __long_aligned = { > + 0, 0, 0, 0, 0, 0 > +}; __long_aligned won't prevent KASAN from barking, it's still 6 bytes but we are reading 8. Can we please do "ETH_ALEN + 2" as below? > static u16 ad_ticks_per_sec; > static const int ad_delta_in_ticks = (AD_TIMER_INTERVAL * HZ) / 1000; > > -static const u8 lacpdu_mcast_addr[ETH_ALEN] = MULTICAST_LACPDU_ADDR; > +static const u8 lacpdu_mcast_addr[ETH_ALEN] __long_aligned = > + MULTICAST_LACPDU_ADDR; > > /* ================= main 802.3ad protocol functions ================== */ > static int ad_lacpdu_send(struct port *port); > @@ -1739,7 +1742,7 @@ static void ad_clear_agg(struct aggregator *aggregator) > aggregator->is_individual = false; > aggregator->actor_admin_aggregator_key = 0; > aggregator->actor_oper_aggregator_key = 0; > - aggregator->partner_system = null_mac_addr; > + eth_zero_addr(aggregator->partner_system.mac_addr_value); > aggregator->partner_system_priority = 0; > aggregator->partner_oper_aggregator_key = 0; > aggregator->receive_state = 0; > @@ -1761,7 +1764,7 @@ static void ad_initialize_agg(struct aggregator *aggregator) > if (aggregator) { > ad_clear_agg(aggregator); > > - aggregator->aggregator_mac_address = null_mac_addr; > + eth_zero_addr(aggregator->aggregator_mac_address.mac_addr_value); > aggregator->aggregator_identifier = 0; > aggregator->slave = NULL; > } > diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c > index c5ac160a8ae9..26beed070bf0 100644 > --- a/drivers/net/bonding/bond_alb.c > +++ b/drivers/net/bonding/bond_alb.c > @@ -42,9 +42,6 @@ > > > > -#ifndef __long_aligned > -#define __long_aligned __attribute__((aligned((sizeof(long))))) > -#endif > static const u8 mac_bcast[ETH_ALEN] __long_aligned = { > 0xff, 0xff, 0xff, 0xff, 0xff, 0xff > }; > diff --git a/include/net/bonding.h b/include/net/bonding.h > index 791800ddd6d9..6360c259da6d 100644 > --- a/include/net/bonding.h > +++ b/include/net/bonding.h > @@ -34,6 +34,9 @@ > > #define BOND_DEFAULT_MIIMON 100 > > +#ifndef __long_aligned > +#define __long_aligned __attribute__((aligned((sizeof(long))))) > +#endif > /* > * Less bad way to call ioctl from within the kernel; this needs to be > * done some other way to get the call out of interrupt context. > @@ -138,7 +141,9 @@ struct bond_params { > struct reciprocal_value reciprocal_packets_per_slave; > u16 ad_actor_sys_prio; > u16 ad_user_port_key; > - u8 ad_actor_system[ETH_ALEN]; > + > + /* 2 bytes of padding : see ether_addr_equal_64bits() */ > + u8 ad_actor_system[ETH_ALEN + 2]; > }; > > struct bond_parm_tbl { > > ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net] bonding: prevent out of bound accesses 2016-06-30 13:04 ` Dmitry Vyukov @ 2016-06-30 13:25 ` Eric Dumazet 2016-06-30 13:35 ` Dmitry Vyukov 0 siblings, 1 reply; 12+ messages in thread From: Eric Dumazet @ 2016-06-30 13:25 UTC (permalink / raw) To: Dmitry Vyukov Cc: David Miller, netdev, Mahesh Bandewar, Nikolay Aleksandrov, Ding Tianhong On Thu, 2016-06-30 at 15:04 +0200, Dmitry Vyukov wrote: > On Thu, Jun 30, 2016 at 2:56 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote: > > From: Eric Dumazet <edumazet@google.com> > > > > ether_addr_equal_64bits() requires some care about its arguments, > > namely that 8 bytes might be read, even if last 2 byte values are not > > used. > > > > KASan detected a violation with null_mac_addr and lacpdu_mcast_addr > > in bond_3ad.c > > > > Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare") > > Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr") > > Signed-off-by: Eric Dumazet <edumazet@google.com> > > Reported-by: Dmitry Vyukov <dvyukov@google.com> > > --- > > drivers/net/bonding/bond_3ad.c | 11 +++++++---- > > drivers/net/bonding/bond_alb.c | 3 --- > > include/net/bonding.h | 7 ++++++- > > 3 files changed, 13 insertions(+), 8 deletions(-) > > > > diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c > > index ca81f46ea1aa..8ad491ab1d01 100644 > > --- a/drivers/net/bonding/bond_3ad.c > > +++ b/drivers/net/bonding/bond_3ad.c > > @@ -101,11 +101,14 @@ enum ad_link_speed_type { > > #define MAC_ADDRESS_EQUAL(A, B) \ > > ether_addr_equal_64bits((const u8 *)A, (const u8 *)B) > > > > -static struct mac_addr null_mac_addr = { { 0, 0, 0, 0, 0, 0 } }; > > +static const u8 null_mac_addr[ETH_ALEN] __long_aligned = { > > + 0, 0, 0, 0, 0, 0 > > +}; > > __long_aligned won't prevent KASAN from barking, it's still 6 bytes > but we are reading 8. > Can we please do "ETH_ALEN + 2" as below? Really ? sizeof(null_mac_addr) is 8, how KASan would decide it is 6 bytes ? nm -v drivers/net/bonding/bonding.ko|grep -3 null_mac_addr 000000000000084a r __UNIQUE_ID_mode17 0000000000000850 r tmpl.46263 0000000000000860 r lacpdu_mcast_addr 0000000000000868 r null_mac_addr 0000000000000870 r mac_v6_allmcast 0000000000000878 r mac_bcast 0000000000000880 r slave_sysfs_ops Same trick was used in https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=885a136c52a8871175477baf3903e1c38751b35a ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net] bonding: prevent out of bound accesses 2016-06-30 13:25 ` Eric Dumazet @ 2016-06-30 13:35 ` Dmitry Vyukov 2016-06-30 14:08 ` Eric Dumazet 0 siblings, 1 reply; 12+ messages in thread From: Dmitry Vyukov @ 2016-06-30 13:35 UTC (permalink / raw) To: Eric Dumazet Cc: David Miller, netdev, Mahesh Bandewar, Nikolay Aleksandrov, Ding Tianhong On Thu, Jun 30, 2016 at 3:25 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote: > On Thu, 2016-06-30 at 15:04 +0200, Dmitry Vyukov wrote: >> On Thu, Jun 30, 2016 at 2:56 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote: >> > From: Eric Dumazet <edumazet@google.com> >> > >> > ether_addr_equal_64bits() requires some care about its arguments, >> > namely that 8 bytes might be read, even if last 2 byte values are not >> > used. >> > >> > KASan detected a violation with null_mac_addr and lacpdu_mcast_addr >> > in bond_3ad.c >> > >> > Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare") >> > Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr") >> > Signed-off-by: Eric Dumazet <edumazet@google.com> >> > Reported-by: Dmitry Vyukov <dvyukov@google.com> >> > --- >> > drivers/net/bonding/bond_3ad.c | 11 +++++++---- >> > drivers/net/bonding/bond_alb.c | 3 --- >> > include/net/bonding.h | 7 ++++++- >> > 3 files changed, 13 insertions(+), 8 deletions(-) >> > >> > diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c >> > index ca81f46ea1aa..8ad491ab1d01 100644 >> > --- a/drivers/net/bonding/bond_3ad.c >> > +++ b/drivers/net/bonding/bond_3ad.c >> > @@ -101,11 +101,14 @@ enum ad_link_speed_type { >> > #define MAC_ADDRESS_EQUAL(A, B) \ >> > ether_addr_equal_64bits((const u8 *)A, (const u8 *)B) >> > >> > -static struct mac_addr null_mac_addr = { { 0, 0, 0, 0, 0, 0 } }; >> > +static const u8 null_mac_addr[ETH_ALEN] __long_aligned = { >> > + 0, 0, 0, 0, 0, 0 >> > +}; >> >> __long_aligned won't prevent KASAN from barking, it's still 6 bytes >> but we are reading 8. >> Can we please do "ETH_ALEN + 2" as below? > > Really ? > > sizeof(null_mac_addr) is 8, how KASan would decide it is 6 bytes ? > > nm -v drivers/net/bonding/bonding.ko|grep -3 null_mac_addr > > 000000000000084a r __UNIQUE_ID_mode17 > 0000000000000850 r tmpl.46263 > 0000000000000860 r lacpdu_mcast_addr > 0000000000000868 r null_mac_addr > 0000000000000870 r mac_v6_allmcast > 0000000000000878 r mac_bcast > 0000000000000880 r slave_sysfs_ops What does nm -S say? I've tried to compile a sample program with gcc6 and __attribute__((aligned(8))) does in fact force alignment of start of the symbol, but size still stays 6. (and asan still barks on my test program). ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net] bonding: prevent out of bound accesses 2016-06-30 13:35 ` Dmitry Vyukov @ 2016-06-30 14:08 ` Eric Dumazet 2016-06-30 14:13 ` Dmitry Vyukov 0 siblings, 1 reply; 12+ messages in thread From: Eric Dumazet @ 2016-06-30 14:08 UTC (permalink / raw) To: Dmitry Vyukov Cc: David Miller, netdev, Mahesh Bandewar, Nikolay Aleksandrov, Ding Tianhong On Thu, 2016-06-30 at 15:35 +0200, Dmitry Vyukov wrote: > > What does nm -S say? > I've tried to compile a sample program with gcc6 and > __attribute__((aligned(8))) does in fact force alignment of start of > the symbol, but size still stays 6. (and asan still barks on my test > program). Right, but then it means I also need to change mac_bcast[] and mac_v6_allmcast[] in bond_alb.c to avoid false positive. (Technically, if their alignment is 8, we have 8 bytes there, no way it could span 2 pages) I'll send a v2. ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net] bonding: prevent out of bound accesses 2016-06-30 14:08 ` Eric Dumazet @ 2016-06-30 14:13 ` Dmitry Vyukov 0 siblings, 0 replies; 12+ messages in thread From: Dmitry Vyukov @ 2016-06-30 14:13 UTC (permalink / raw) To: Eric Dumazet Cc: David Miller, netdev, Mahesh Bandewar, Nikolay Aleksandrov, Ding Tianhong On Thu, Jun 30, 2016 at 4:08 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote: > On Thu, 2016-06-30 at 15:35 +0200, Dmitry Vyukov wrote: > >> >> What does nm -S say? >> I've tried to compile a sample program with gcc6 and >> __attribute__((aligned(8))) does in fact force alignment of start of >> the symbol, but size still stays 6. (and asan still barks on my test >> program). > > Right, but then it means I also need to change mac_bcast[] and > mac_v6_allmcast[] in bond_alb.c to avoid false positive. > > (Technically, if their alignment is 8, we have 8 bytes there, > no way it could span 2 pages) Agree. > I'll send a v2. Thanks! ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net] bonding: prevent out of bound accesses 2016-06-30 12:56 [PATCH net] bonding: prevent out of bound accesses Eric Dumazet 2016-06-30 13:04 ` Dmitry Vyukov @ 2016-06-30 13:24 ` Nikolay Aleksandrov 2016-06-30 14:13 ` [PATCH v2 " Eric Dumazet 2 siblings, 0 replies; 12+ messages in thread From: Nikolay Aleksandrov @ 2016-06-30 13:24 UTC (permalink / raw) To: Eric Dumazet, David Miller Cc: netdev, Mahesh Bandewar, Nikolay Aleksandrov, Ding Tianhong, Dmitry Vyukov On 30/06/16 14:56, Eric Dumazet wrote: > From: Eric Dumazet <edumazet@google.com> > > ether_addr_equal_64bits() requires some care about its arguments, > namely that 8 bytes might be read, even if last 2 byte values are not > used. > > KASan detected a violation with null_mac_addr and lacpdu_mcast_addr > in bond_3ad.c > > Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare") > Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr") > Signed-off-by: Eric Dumazet <edumazet@google.com> > Reported-by: Dmitry Vyukov <dvyukov@google.com> > --- > drivers/net/bonding/bond_3ad.c | 11 +++++++---- > drivers/net/bonding/bond_alb.c | 3 --- > include/net/bonding.h | 7 ++++++- > 3 files changed, 13 insertions(+), 8 deletions(-) > Good catch, Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> ^ permalink raw reply [flat|nested] 12+ messages in thread
* [PATCH v2 net] bonding: prevent out of bound accesses 2016-06-30 12:56 [PATCH net] bonding: prevent out of bound accesses Eric Dumazet 2016-06-30 13:04 ` Dmitry Vyukov 2016-06-30 13:24 ` Nikolay Aleksandrov @ 2016-06-30 14:13 ` Eric Dumazet 2016-06-30 14:19 ` Dmitry Vyukov ` (3 more replies) 2 siblings, 4 replies; 12+ messages in thread From: Eric Dumazet @ 2016-06-30 14:13 UTC (permalink / raw) To: David Miller Cc: netdev, Mahesh Bandewar, Nikolay Aleksandrov, Ding Tianhong, Dmitry Vyukov From: Eric Dumazet <edumazet@google.com> ether_addr_equal_64bits() requires some care about its arguments, namely that 8 bytes might be read, even if last 2 byte values are not used. KASan detected a violation with null_mac_addr and lacpdu_mcast_addr in bond_3ad.c Same problem with mac_bcast[] and mac_v6_allmcast[] in bond_alb.c : Although the 8-byte alignment was there, KASan would detect out of bound accesses. Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare") Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr") Fixes: 885a136c52a8 ("bonding: use compare_ether_addr_64bits() in ALB") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Dmitry Vyukov <dvyukov@google.com> --- drivers/net/bonding/bond_3ad.c | 11 +++++++---- drivers/net/bonding/bond_alb.c | 7 ++----- include/net/bonding.h | 7 ++++++- 3 files changed, 15 insertions(+), 10 deletions(-) diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c index ca81f46ea1aa..8ad491ab1d01 100644 --- a/drivers/net/bonding/bond_3ad.c +++ b/drivers/net/bonding/bond_3ad.c @@ -101,11 +101,14 @@ enum ad_link_speed_type { #define MAC_ADDRESS_EQUAL(A, B) \ ether_addr_equal_64bits((const u8 *)A, (const u8 *)B) -static struct mac_addr null_mac_addr = { { 0, 0, 0, 0, 0, 0 } }; +static const u8 null_mac_addr[ETH_ALEN + 2] __long_aligned = { + 0, 0, 0, 0, 0, 0 +}; static u16 ad_ticks_per_sec; static const int ad_delta_in_ticks = (AD_TIMER_INTERVAL * HZ) / 1000; -static const u8 lacpdu_mcast_addr[ETH_ALEN] = MULTICAST_LACPDU_ADDR; +static const u8 lacpdu_mcast_addr[ETH_ALEN + 2] __long_aligned = + MULTICAST_LACPDU_ADDR; /* ================= main 802.3ad protocol functions ================== */ static int ad_lacpdu_send(struct port *port); @@ -1739,7 +1742,7 @@ static void ad_clear_agg(struct aggregator *aggregator) aggregator->is_individual = false; aggregator->actor_admin_aggregator_key = 0; aggregator->actor_oper_aggregator_key = 0; - aggregator->partner_system = null_mac_addr; + eth_zero_addr(aggregator->partner_system.mac_addr_value); aggregator->partner_system_priority = 0; aggregator->partner_oper_aggregator_key = 0; aggregator->receive_state = 0; @@ -1761,7 +1764,7 @@ static void ad_initialize_agg(struct aggregator *aggregator) if (aggregator) { ad_clear_agg(aggregator); - aggregator->aggregator_mac_address = null_mac_addr; + eth_zero_addr(aggregator->aggregator_mac_address.mac_addr_value); aggregator->aggregator_identifier = 0; aggregator->slave = NULL; } diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index c5ac160a8ae9..551f0f8dead3 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -42,13 +42,10 @@ -#ifndef __long_aligned -#define __long_aligned __attribute__((aligned((sizeof(long))))) -#endif -static const u8 mac_bcast[ETH_ALEN] __long_aligned = { +static const u8 mac_bcast[ETH_ALEN + 2] __long_aligned = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; -static const u8 mac_v6_allmcast[ETH_ALEN] __long_aligned = { +static const u8 mac_v6_allmcast[ETH_ALEN + 2] __long_aligned = { 0x33, 0x33, 0x00, 0x00, 0x00, 0x01 }; static const int alb_delta_in_ticks = HZ / ALB_TIMER_TICKS_PER_SEC; diff --git a/include/net/bonding.h b/include/net/bonding.h index 791800ddd6d9..6360c259da6d 100644 --- a/include/net/bonding.h +++ b/include/net/bonding.h @@ -34,6 +34,9 @@ #define BOND_DEFAULT_MIIMON 100 +#ifndef __long_aligned +#define __long_aligned __attribute__((aligned((sizeof(long))))) +#endif /* * Less bad way to call ioctl from within the kernel; this needs to be * done some other way to get the call out of interrupt context. @@ -138,7 +141,9 @@ struct bond_params { struct reciprocal_value reciprocal_packets_per_slave; u16 ad_actor_sys_prio; u16 ad_user_port_key; - u8 ad_actor_system[ETH_ALEN]; + + /* 2 bytes of padding : see ether_addr_equal_64bits() */ + u8 ad_actor_system[ETH_ALEN + 2]; }; struct bond_parm_tbl { ^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [PATCH v2 net] bonding: prevent out of bound accesses 2016-06-30 14:13 ` [PATCH v2 " Eric Dumazet @ 2016-06-30 14:19 ` Dmitry Vyukov 2016-06-30 14:43 ` Nikolay Aleksandrov ` (2 subsequent siblings) 3 siblings, 0 replies; 12+ messages in thread From: Dmitry Vyukov @ 2016-06-30 14:19 UTC (permalink / raw) To: Eric Dumazet Cc: David Miller, netdev, Mahesh Bandewar, Nikolay Aleksandrov, Ding Tianhong On Thu, Jun 30, 2016 at 4:13 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote: > From: Eric Dumazet <edumazet@google.com> > > ether_addr_equal_64bits() requires some care about its arguments, > namely that 8 bytes might be read, even if last 2 byte values are not > used. > > KASan detected a violation with null_mac_addr and lacpdu_mcast_addr > in bond_3ad.c > > Same problem with mac_bcast[] and mac_v6_allmcast[] in bond_alb.c : > Although the 8-byte alignment was there, KASan would detect out > of bound accesses. > > Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare") > Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr") > Fixes: 885a136c52a8 ("bonding: use compare_ether_addr_64bits() in ALB") > Signed-off-by: Eric Dumazet <edumazet@google.com> > Reported-by: Dmitry Vyukov <dvyukov@google.com> > --- > drivers/net/bonding/bond_3ad.c | 11 +++++++---- > drivers/net/bonding/bond_alb.c | 7 ++----- > include/net/bonding.h | 7 ++++++- > 3 files changed, 15 insertions(+), 10 deletions(-) > > diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c > index ca81f46ea1aa..8ad491ab1d01 100644 > --- a/drivers/net/bonding/bond_3ad.c > +++ b/drivers/net/bonding/bond_3ad.c > @@ -101,11 +101,14 @@ enum ad_link_speed_type { > #define MAC_ADDRESS_EQUAL(A, B) \ > ether_addr_equal_64bits((const u8 *)A, (const u8 *)B) > > -static struct mac_addr null_mac_addr = { { 0, 0, 0, 0, 0, 0 } }; > +static const u8 null_mac_addr[ETH_ALEN + 2] __long_aligned = { > + 0, 0, 0, 0, 0, 0 > +}; > static u16 ad_ticks_per_sec; > static const int ad_delta_in_ticks = (AD_TIMER_INTERVAL * HZ) / 1000; > > -static const u8 lacpdu_mcast_addr[ETH_ALEN] = MULTICAST_LACPDU_ADDR; > +static const u8 lacpdu_mcast_addr[ETH_ALEN + 2] __long_aligned = > + MULTICAST_LACPDU_ADDR; > > /* ================= main 802.3ad protocol functions ================== */ > static int ad_lacpdu_send(struct port *port); > @@ -1739,7 +1742,7 @@ static void ad_clear_agg(struct aggregator *aggregator) > aggregator->is_individual = false; > aggregator->actor_admin_aggregator_key = 0; > aggregator->actor_oper_aggregator_key = 0; > - aggregator->partner_system = null_mac_addr; > + eth_zero_addr(aggregator->partner_system.mac_addr_value); > aggregator->partner_system_priority = 0; > aggregator->partner_oper_aggregator_key = 0; > aggregator->receive_state = 0; > @@ -1761,7 +1764,7 @@ static void ad_initialize_agg(struct aggregator *aggregator) > if (aggregator) { > ad_clear_agg(aggregator); > > - aggregator->aggregator_mac_address = null_mac_addr; > + eth_zero_addr(aggregator->aggregator_mac_address.mac_addr_value); > aggregator->aggregator_identifier = 0; > aggregator->slave = NULL; > } > diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c > index c5ac160a8ae9..551f0f8dead3 100644 > --- a/drivers/net/bonding/bond_alb.c > +++ b/drivers/net/bonding/bond_alb.c > @@ -42,13 +42,10 @@ > > > > -#ifndef __long_aligned > -#define __long_aligned __attribute__((aligned((sizeof(long))))) > -#endif > -static const u8 mac_bcast[ETH_ALEN] __long_aligned = { > +static const u8 mac_bcast[ETH_ALEN + 2] __long_aligned = { > 0xff, 0xff, 0xff, 0xff, 0xff, 0xff > }; > -static const u8 mac_v6_allmcast[ETH_ALEN] __long_aligned = { > +static const u8 mac_v6_allmcast[ETH_ALEN + 2] __long_aligned = { > 0x33, 0x33, 0x00, 0x00, 0x00, 0x01 > }; > static const int alb_delta_in_ticks = HZ / ALB_TIMER_TICKS_PER_SEC; > diff --git a/include/net/bonding.h b/include/net/bonding.h > index 791800ddd6d9..6360c259da6d 100644 > --- a/include/net/bonding.h > +++ b/include/net/bonding.h > @@ -34,6 +34,9 @@ > > #define BOND_DEFAULT_MIIMON 100 > > +#ifndef __long_aligned > +#define __long_aligned __attribute__((aligned((sizeof(long))))) > +#endif > /* > * Less bad way to call ioctl from within the kernel; this needs to be > * done some other way to get the call out of interrupt context. > @@ -138,7 +141,9 @@ struct bond_params { > struct reciprocal_value reciprocal_packets_per_slave; > u16 ad_actor_sys_prio; > u16 ad_user_port_key; > - u8 ad_actor_system[ETH_ALEN]; > + > + /* 2 bytes of padding : see ether_addr_equal_64bits() */ > + u8 ad_actor_system[ETH_ALEN + 2]; > }; > > struct bond_parm_tbl { Acked-by: Dmitry Vyukov <dvyukov@google.com> ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH v2 net] bonding: prevent out of bound accesses 2016-06-30 14:13 ` [PATCH v2 " Eric Dumazet 2016-06-30 14:19 ` Dmitry Vyukov @ 2016-06-30 14:43 ` Nikolay Aleksandrov 2016-07-01 1:09 ` Ding Tianhong 2016-07-01 10:06 ` David Miller 3 siblings, 0 replies; 12+ messages in thread From: Nikolay Aleksandrov @ 2016-06-30 14:43 UTC (permalink / raw) To: Eric Dumazet, David Miller Cc: netdev, Mahesh Bandewar, Nikolay Aleksandrov, Ding Tianhong, Dmitry Vyukov, Jay Vosburgh, Veaceslav Falico, Andy Gospodarek On 30/06/16 16:13, Eric Dumazet wrote: > From: Eric Dumazet <edumazet@google.com> > > ether_addr_equal_64bits() requires some care about its arguments, > namely that 8 bytes might be read, even if last 2 byte values are not > used. > > KASan detected a violation with null_mac_addr and lacpdu_mcast_addr > in bond_3ad.c > > Same problem with mac_bcast[] and mac_v6_allmcast[] in bond_alb.c : > Although the 8-byte alignment was there, KASan would detect out > of bound accesses. > > Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare") > Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr") > Fixes: 885a136c52a8 ("bonding: use compare_ether_addr_64bits() in ALB") > Signed-off-by: Eric Dumazet <edumazet@google.com> > Reported-by: Dmitry Vyukov <dvyukov@google.com> > --- > drivers/net/bonding/bond_3ad.c | 11 +++++++---- > drivers/net/bonding/bond_alb.c | 7 ++----- > include/net/bonding.h | 7 ++++++- > 3 files changed, 15 insertions(+), 10 deletions(-) > +CC bonding maintainers For v2, Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH v2 net] bonding: prevent out of bound accesses 2016-06-30 14:13 ` [PATCH v2 " Eric Dumazet 2016-06-30 14:19 ` Dmitry Vyukov 2016-06-30 14:43 ` Nikolay Aleksandrov @ 2016-07-01 1:09 ` Ding Tianhong 2016-07-01 10:06 ` David Miller 3 siblings, 0 replies; 12+ messages in thread From: Ding Tianhong @ 2016-07-01 1:09 UTC (permalink / raw) To: Eric Dumazet, David Miller Cc: netdev, Mahesh Bandewar, Nikolay Aleksandrov, Dmitry Vyukov On 2016/6/30 22:13, Eric Dumazet wrote: > From: Eric Dumazet <edumazet@google.com> > > ether_addr_equal_64bits() requires some care about its arguments, > namely that 8 bytes might be read, even if last 2 byte values are not > used. > > KASan detected a violation with null_mac_addr and lacpdu_mcast_addr > in bond_3ad.c > > Same problem with mac_bcast[] and mac_v6_allmcast[] in bond_alb.c : > Although the 8-byte alignment was there, KASan would detect out > of bound accesses. > > Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare") > Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr") > Fixes: 885a136c52a8 ("bonding: use compare_ether_addr_64bits() in ALB") > Signed-off-by: Eric Dumazet <edumazet@google.com> > Reported-by: Dmitry Vyukov <dvyukov@google.com> > --- > drivers/net/bonding/bond_3ad.c | 11 +++++++---- > drivers/net/bonding/bond_alb.c | 7 ++----- > include/net/bonding.h | 7 ++++++- > 3 files changed, 15 insertions(+), 10 deletions(-) > > diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c > index ca81f46ea1aa..8ad491ab1d01 100644 > --- a/drivers/net/bonding/bond_3ad.c > +++ b/drivers/net/bonding/bond_3ad.c > @@ -101,11 +101,14 @@ enum ad_link_speed_type { > #define MAC_ADDRESS_EQUAL(A, B) \ > ether_addr_equal_64bits((const u8 *)A, (const u8 *)B) > > -static struct mac_addr null_mac_addr = { { 0, 0, 0, 0, 0, 0 } }; > +static const u8 null_mac_addr[ETH_ALEN + 2] __long_aligned = { > + 0, 0, 0, 0, 0, 0 > +}; > static u16 ad_ticks_per_sec; > static const int ad_delta_in_ticks = (AD_TIMER_INTERVAL * HZ) / 1000; > > -static const u8 lacpdu_mcast_addr[ETH_ALEN] = MULTICAST_LACPDU_ADDR; > +static const u8 lacpdu_mcast_addr[ETH_ALEN + 2] __long_aligned = > + MULTICAST_LACPDU_ADDR; > > /* ================= main 802.3ad protocol functions ================== */ > static int ad_lacpdu_send(struct port *port); > @@ -1739,7 +1742,7 @@ static void ad_clear_agg(struct aggregator *aggregator) > aggregator->is_individual = false; > aggregator->actor_admin_aggregator_key = 0; > aggregator->actor_oper_aggregator_key = 0; > - aggregator->partner_system = null_mac_addr; > + eth_zero_addr(aggregator->partner_system.mac_addr_value); > aggregator->partner_system_priority = 0; > aggregator->partner_oper_aggregator_key = 0; > aggregator->receive_state = 0; > @@ -1761,7 +1764,7 @@ static void ad_initialize_agg(struct aggregator *aggregator) > if (aggregator) { > ad_clear_agg(aggregator); > > - aggregator->aggregator_mac_address = null_mac_addr; > + eth_zero_addr(aggregator->aggregator_mac_address.mac_addr_value); > aggregator->aggregator_identifier = 0; > aggregator->slave = NULL; > } > diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c > index c5ac160a8ae9..551f0f8dead3 100644 > --- a/drivers/net/bonding/bond_alb.c > +++ b/drivers/net/bonding/bond_alb.c > @@ -42,13 +42,10 @@ > > > > -#ifndef __long_aligned > -#define __long_aligned __attribute__((aligned((sizeof(long))))) > -#endif > -static const u8 mac_bcast[ETH_ALEN] __long_aligned = { > +static const u8 mac_bcast[ETH_ALEN + 2] __long_aligned = { > 0xff, 0xff, 0xff, 0xff, 0xff, 0xff > }; > -static const u8 mac_v6_allmcast[ETH_ALEN] __long_aligned = { > +static const u8 mac_v6_allmcast[ETH_ALEN + 2] __long_aligned = { > 0x33, 0x33, 0x00, 0x00, 0x00, 0x01 > }; > static const int alb_delta_in_ticks = HZ / ALB_TIMER_TICKS_PER_SEC; > diff --git a/include/net/bonding.h b/include/net/bonding.h > index 791800ddd6d9..6360c259da6d 100644 > --- a/include/net/bonding.h > +++ b/include/net/bonding.h > @@ -34,6 +34,9 @@ > > #define BOND_DEFAULT_MIIMON 100 > > +#ifndef __long_aligned > +#define __long_aligned __attribute__((aligned((sizeof(long))))) > +#endif > /* > * Less bad way to call ioctl from within the kernel; this needs to be > * done some other way to get the call out of interrupt context. > @@ -138,7 +141,9 @@ struct bond_params { > struct reciprocal_value reciprocal_packets_per_slave; > u16 ad_actor_sys_prio; > u16 ad_user_port_key; > - u8 ad_actor_system[ETH_ALEN]; > + > + /* 2 bytes of padding : see ether_addr_equal_64bits() */ > + u8 ad_actor_system[ETH_ALEN + 2]; > }; > > struct bond_parm_tbl { > > > > . It is fine to me. Acked-by: Ding Tianhong <dingtianhong@huawei.com> > ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH v2 net] bonding: prevent out of bound accesses 2016-06-30 14:13 ` [PATCH v2 " Eric Dumazet ` (2 preceding siblings ...) 2016-07-01 1:09 ` Ding Tianhong @ 2016-07-01 10:06 ` David Miller 3 siblings, 0 replies; 12+ messages in thread From: David Miller @ 2016-07-01 10:06 UTC (permalink / raw) To: eric.dumazet; +Cc: netdev, maheshb, nikolay, dingtianhong, dvyukov From: Eric Dumazet <eric.dumazet@gmail.com> Date: Thu, 30 Jun 2016 16:13:41 +0200 > From: Eric Dumazet <edumazet@google.com> > > ether_addr_equal_64bits() requires some care about its arguments, > namely that 8 bytes might be read, even if last 2 byte values are not > used. > > KASan detected a violation with null_mac_addr and lacpdu_mcast_addr > in bond_3ad.c > > Same problem with mac_bcast[] and mac_v6_allmcast[] in bond_alb.c : > Although the 8-byte alignment was there, KASan would detect out > of bound accesses. > > Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare") > Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr") > Fixes: 885a136c52a8 ("bonding: use compare_ether_addr_64bits() in ALB") > Signed-off-by: Eric Dumazet <edumazet@google.com> > Reported-by: Dmitry Vyukov <dvyukov@google.com> Applied, thanks Eric. ^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2016-07-01 10:07 UTC | newest] Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2016-06-30 12:56 [PATCH net] bonding: prevent out of bound accesses Eric Dumazet 2016-06-30 13:04 ` Dmitry Vyukov 2016-06-30 13:25 ` Eric Dumazet 2016-06-30 13:35 ` Dmitry Vyukov 2016-06-30 14:08 ` Eric Dumazet 2016-06-30 14:13 ` Dmitry Vyukov 2016-06-30 13:24 ` Nikolay Aleksandrov 2016-06-30 14:13 ` [PATCH v2 " Eric Dumazet 2016-06-30 14:19 ` Dmitry Vyukov 2016-06-30 14:43 ` Nikolay Aleksandrov 2016-07-01 1:09 ` Ding Tianhong 2016-07-01 10:06 ` David Miller
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.