* [Patch net] net_sched: fix datalen for ematch
@ 2020-01-22 23:42 Cong Wang
2020-01-22 23:45 ` Eric Dumazet
2020-01-23 20:35 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Cong Wang @ 2020-01-22 23:42 UTC (permalink / raw)
To: netdev
Cc: Cong Wang, syzbot+5af9a90dad568aa9f611,
syzbot+2f07903a5b05e7f36410, Eric Dumazet
syzbot reported an out-of-bound access in em_nbyte. As initially
analyzed by Eric, this is because em_nbyte sets its own em->datalen
in em_nbyte_change() other than the one specified by user, but this
value gets overwritten later by its caller tcf_em_validate().
We should leave em->datalen untouched to respect their choices.
I audit all the in-tree ematch users, all of those implement
->change() set em->datalen, so we can just avoid setting it twice
in this case.
Reported-and-tested-by: syzbot+5af9a90dad568aa9f611@syzkaller.appspotmail.com
Reported-by: syzbot+2f07903a5b05e7f36410@syzkaller.appspotmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
net/sched/ematch.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/sched/ematch.c b/net/sched/ematch.c
index 8f2ad706784d..d0140a92694a 100644
--- a/net/sched/ematch.c
+++ b/net/sched/ematch.c
@@ -263,12 +263,12 @@ static int tcf_em_validate(struct tcf_proto *tp,
}
em->data = (unsigned long) v;
}
+ em->datalen = data_len;
}
}
em->matchid = em_hdr->matchid;
em->flags = em_hdr->flags;
- em->datalen = data_len;
em->net = net;
err = 0;
--
2.21.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [Patch net] net_sched: fix datalen for ematch
2020-01-22 23:42 [Patch net] net_sched: fix datalen for ematch Cong Wang
@ 2020-01-22 23:45 ` Eric Dumazet
2020-01-23 20:35 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Eric Dumazet @ 2020-01-22 23:45 UTC (permalink / raw)
To: Cong Wang, netdev
Cc: syzbot+5af9a90dad568aa9f611, syzbot+2f07903a5b05e7f36410, Eric Dumazet
On 1/22/20 3:42 PM, Cong Wang wrote:
> syzbot reported an out-of-bound access in em_nbyte. As initially
> analyzed by Eric, this is because em_nbyte sets its own em->datalen
> in em_nbyte_change() other than the one specified by user, but this
> value gets overwritten later by its caller tcf_em_validate().
> We should leave em->datalen untouched to respect their choices.
>
> I audit all the in-tree ematch users, all of those implement
> ->change() set em->datalen, so we can just avoid setting it twice
> in this case.
>
> Reported-and-tested-by: syzbot+5af9a90dad568aa9f611@syzkaller.appspotmail.com
> Reported-by: syzbot+2f07903a5b05e7f36410@syzkaller.appspotmail.com
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: Eric Dumazet <eric.dumazet@gmail.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
> ---
>
SGTM, thanks.
Reviewed-by: Eric Dumazet <edumazet@google.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [Patch net] net_sched: fix datalen for ematch
2020-01-22 23:42 [Patch net] net_sched: fix datalen for ematch Cong Wang
2020-01-22 23:45 ` Eric Dumazet
@ 2020-01-23 20:35 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2020-01-23 20:35 UTC (permalink / raw)
To: xiyou.wangcong
Cc: netdev, syzbot+5af9a90dad568aa9f611, syzbot+2f07903a5b05e7f36410,
eric.dumazet
From: Cong Wang <xiyou.wangcong@gmail.com>
Date: Wed, 22 Jan 2020 15:42:02 -0800
> syzbot reported an out-of-bound access in em_nbyte. As initially
> analyzed by Eric, this is because em_nbyte sets its own em->datalen
> in em_nbyte_change() other than the one specified by user, but this
> value gets overwritten later by its caller tcf_em_validate().
> We should leave em->datalen untouched to respect their choices.
>
> I audit all the in-tree ematch users, all of those implement
> ->change() set em->datalen, so we can just avoid setting it twice
> in this case.
>
> Reported-and-tested-by: syzbot+5af9a90dad568aa9f611@syzkaller.appspotmail.com
> Reported-by: syzbot+2f07903a5b05e7f36410@syzkaller.appspotmail.com
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: Eric Dumazet <eric.dumazet@gmail.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Applied and queued up for -stable, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-01-23 20:35 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-01-22 23:42 [Patch net] net_sched: fix datalen for ematch Cong Wang
2020-01-22 23:45 ` Eric Dumazet
2020-01-23 20:35 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).