* [PATCH] openvswitch: fix a use after free
@ 2014-10-16 9:01 roy.qing.li
2014-10-16 14:12 ` Eric Dumazet
0 siblings, 1 reply; 6+ messages in thread
From: roy.qing.li @ 2014-10-16 9:01 UTC (permalink / raw)
To: netdev
From: Li RongQing <roy.qing.li@gmail.com>
pskb_may_pull() called by arphdr_ok can change skb->data, so put the arp
setting after arphdr_ok to avoid the use the freed memory
Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
---
net/openvswitch/flow.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 62db02b..b13ba5e 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -557,10 +557,11 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
} else if (key->eth.type == htons(ETH_P_ARP) ||
key->eth.type == htons(ETH_P_RARP)) {
struct arp_eth_header *arp;
+ bool arp_t = arphdr_ok(skb);
arp = (struct arp_eth_header *)skb_network_header(skb);
- if (arphdr_ok(skb) &&
+ if (arp_t &&
arp->ar_hrd == htons(ARPHRD_ETHER) &&
arp->ar_pro == htons(ETH_P_IP) &&
arp->ar_hln == ETH_ALEN &&
--
1.7.10.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] openvswitch: fix a use after free
2014-10-16 9:01 [PATCH] openvswitch: fix a use after free roy.qing.li
@ 2014-10-16 14:12 ` Eric Dumazet
2014-10-16 14:58 ` Jesse Gross
0 siblings, 1 reply; 6+ messages in thread
From: Eric Dumazet @ 2014-10-16 14:12 UTC (permalink / raw)
To: roy.qing.li; +Cc: netdev, Jesse Gross, Andy Zhou, Pravin B Shelar
On Thu, 2014-10-16 at 17:01 +0800, roy.qing.li@gmail.com wrote:
> From: Li RongQing <roy.qing.li@gmail.com>
>
> pskb_may_pull() called by arphdr_ok can change skb->data, so put the arp
> setting after arphdr_ok to avoid the use the freed memory
>
> Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
> ---
> net/openvswitch/flow.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
> index 62db02b..b13ba5e 100644
> --- a/net/openvswitch/flow.c
> +++ b/net/openvswitch/flow.c
> @@ -557,10 +557,11 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
> } else if (key->eth.type == htons(ETH_P_ARP) ||
> key->eth.type == htons(ETH_P_RARP)) {
> struct arp_eth_header *arp;
> + bool arp_t = arphdr_ok(skb);
This is a strange name for a bool. _t suffix is normally used by
typedef.
>
> arp = (struct arp_eth_header *)skb_network_header(skb);
>
> - if (arphdr_ok(skb) &&
> + if (arp_t &&
> arp->ar_hrd == htons(ARPHRD_ETHER) &&
> arp->ar_pro == htons(ETH_P_IP) &&
> arp->ar_hln == ETH_ALEN &&
Fixes: 0714812134d7d ("openvswitch: Eliminate memset() from flow_extract.")
By doing this bug hunting, you also can CC bug author so that he knows
what happened. Maybe he will avoid similar mistakes in the future.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] openvswitch: fix a use after free
2014-10-16 14:12 ` Eric Dumazet
@ 2014-10-16 14:58 ` Jesse Gross
0 siblings, 0 replies; 6+ messages in thread
From: Jesse Gross @ 2014-10-16 14:58 UTC (permalink / raw)
To: Eric Dumazet; +Cc: roy.qing.li, netdev, Andy Zhou, Pravin B Shelar
On Thu, Oct 16, 2014 at 4:12 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
> On Thu, 2014-10-16 at 17:01 +0800, roy.qing.li@gmail.com wrote:
>>
>> arp = (struct arp_eth_header *)skb_network_header(skb);
>>
>> - if (arphdr_ok(skb) &&
>> + if (arp_t &&
>> arp->ar_hrd == htons(ARPHRD_ETHER) &&
>> arp->ar_pro == htons(ETH_P_IP) &&
>> arp->ar_hln == ETH_ALEN &&
>
> Fixes: 0714812134d7d ("openvswitch: Eliminate memset() from flow_extract.")
>
> By doing this bug hunting, you also can CC bug author so that he knows
> what happened. Maybe he will avoid similar mistakes in the future.
Yes, this one is my fault. Thanks for tracking it down.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] openvswitch: fix a use after free
2014-10-17 6:03 roy.qing.li
2014-10-17 15:59 ` Jesse Gross
@ 2014-10-17 20:23 ` David Miller
1 sibling, 0 replies; 6+ messages in thread
From: David Miller @ 2014-10-17 20:23 UTC (permalink / raw)
To: roy.qing.li; +Cc: netdev, edumazet, jesse
From: roy.qing.li@gmail.com
Date: Fri, 17 Oct 2014 14:03:08 +0800
> From: Li RongQing <roy.qing.li@gmail.com>
>
> pskb_may_pull() called by arphdr_ok can change skb->data, so put the arp
> setting after arphdr_ok to avoid the use the freed memory
>
> Fixes: 0714812134d7d ("openvswitch: Eliminate memset() from flow_extract.")
> Cc: Jesse Gross <jesse@nicira.com>
> Cc: Eric Dumazet <edumazet@google.com>
> Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
Applied, thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] openvswitch: fix a use after free
2014-10-17 6:03 roy.qing.li
@ 2014-10-17 15:59 ` Jesse Gross
2014-10-17 20:23 ` David Miller
1 sibling, 0 replies; 6+ messages in thread
From: Jesse Gross @ 2014-10-17 15:59 UTC (permalink / raw)
To: roy.qing.li; +Cc: netdev, Eric Dumazet
On Fri, Oct 17, 2014 at 8:03 AM, <roy.qing.li@gmail.com> wrote:
> From: Li RongQing <roy.qing.li@gmail.com>
>
> pskb_may_pull() called by arphdr_ok can change skb->data, so put the arp
> setting after arphdr_ok to avoid the use the freed memory
>
> Fixes: 0714812134d7d ("openvswitch: Eliminate memset() from flow_extract.")
> Cc: Jesse Gross <jesse@nicira.com>
> Cc: Eric Dumazet <edumazet@google.com>
> Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
Acked-by: Jesse Gross <jesse@nicira.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] openvswitch: fix a use after free
@ 2014-10-17 6:03 roy.qing.li
2014-10-17 15:59 ` Jesse Gross
2014-10-17 20:23 ` David Miller
0 siblings, 2 replies; 6+ messages in thread
From: roy.qing.li @ 2014-10-17 6:03 UTC (permalink / raw)
To: netdev; +Cc: edumazet, jesse
From: Li RongQing <roy.qing.li@gmail.com>
pskb_may_pull() called by arphdr_ok can change skb->data, so put the arp
setting after arphdr_ok to avoid the use the freed memory
Fixes: 0714812134d7d ("openvswitch: Eliminate memset() from flow_extract.")
Cc: Jesse Gross <jesse@nicira.com>
Cc: Eric Dumazet <edumazet@google.com>
Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
---
net/openvswitch/flow.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 62db02b..c5cfc72 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -557,10 +557,11 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
} else if (key->eth.type == htons(ETH_P_ARP) ||
key->eth.type == htons(ETH_P_RARP)) {
struct arp_eth_header *arp;
+ bool arp_available = arphdr_ok(skb);
arp = (struct arp_eth_header *)skb_network_header(skb);
- if (arphdr_ok(skb) &&
+ if (arp_available &&
arp->ar_hrd == htons(ARPHRD_ETHER) &&
arp->ar_pro == htons(ETH_P_IP) &&
arp->ar_hln == ETH_ALEN &&
--
1.7.10.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2014-10-17 20:23 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-10-16 9:01 [PATCH] openvswitch: fix a use after free roy.qing.li
2014-10-16 14:12 ` Eric Dumazet
2014-10-16 14:58 ` Jesse Gross
2014-10-17 6:03 roy.qing.li
2014-10-17 15:59 ` Jesse Gross
2014-10-17 20:23 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).