From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>,
Davide Caratti <dcaratti@redhat.com>,
Jakub Kicinski <kuba@kernel.org>
Subject: [PATCH 5.9 33/46] net: skbuff: ensure LSE is pullable before decrementing the MPLS ttl
Date: Sun, 6 Dec 2020 12:17:41 +0100 [thread overview]
Message-ID: <20201206111558.052432033@linuxfoundation.org> (raw)
In-Reply-To: <20201206111556.455533723@linuxfoundation.org>
From: Davide Caratti <dcaratti@redhat.com>
[ Upstream commit 13de4ed9e3a9ccbe54d05f7d5c773f69ecaf6c64 ]
skb_mpls_dec_ttl() reads the LSE without ensuring that it is contained in
the skb "linear" area. Fix this calling pskb_may_pull() before reading the
current ttl.
Found by code inspection.
Fixes: 2a2ea50870ba ("net: sched: add mpls manipulation actions to TC")
Reported-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Link: https://lore.kernel.org/r/53659f28be8bc336c113b5254dc637cc76bbae91.1606987074.git.dcaratti@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/skbuff.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -5725,6 +5725,9 @@ int skb_mpls_dec_ttl(struct sk_buff *skb
if (unlikely(!eth_p_mpls(skb->protocol)))
return -EINVAL;
+ if (!pskb_may_pull(skb, skb_network_offset(skb) + MPLS_HLEN))
+ return -ENOMEM;
+
lse = be32_to_cpu(mpls_hdr(skb)->label_stack_entry);
ttl = (lse & MPLS_LS_TTL_MASK) >> MPLS_LS_TTL_SHIFT;
if (!--ttl)
next prev parent reply other threads:[~2020-12-06 11:46 UTC|newest]
Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-06 11:17 [PATCH 5.9 00/46] 5.9.13-rc1 review Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 01/46] devlink: Hold rtnl lock while reading netdev attributes Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 02/46] devlink: Make sure devlink instance and port are in same net namespace Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 03/46] ipv6: addrlabel: fix possible memory leak in ip6addrlbl_net_init Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 04/46] net/af_iucv: set correct sk_protocol for child sockets Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 05/46] net: openvswitch: fix TTL decrement action netlink message format Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 06/46] net/tls: missing received data after fast remote close Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 07/46] net/tls: Protect from calling tls_dev_del for TLS RX twice Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 08/46] rose: Fix Null pointer dereference in rose_send_frame() Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 09/46] sock: set sk_err to ee_errno on dequeue from errq Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 10/46] tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 11/46] tun: honor IOCB_NOWAIT flag Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 12/46] usbnet: ipheth: fix connectivity with iOS 14 Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 13/46] vsock/virtio: discard packets only when socket is really closed Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 14/46] mptcp: fix NULL ptr dereference on bad MPJ Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 15/46] net/packet: fix packet receive on L3 devices without visible hard header Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 16/46] netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 17/46] ipv4: Fix tos mask in inet_rtm_getroute() Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 18/46] dt-bindings: net: correct interrupt flags in examples Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 19/46] chelsio/chtls: fix panic during unload reload chtls Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 20/46] ibmvnic: Ensure that SCRQ entry reads are correctly ordered Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 21/46] ibmvnic: Fix TX completion error handling Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 22/46] tipc: fix incompatible mtu of transmission Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 23/46] inet_ecn: Fix endianness of checksum update when setting ECT(1) Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 24/46] geneve: pull IP header before ECN decapsulation Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 25/46] net: ip6_gre: set dev->hard_header_len when using header_ops Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 26/46] dpaa_eth: copy timestamp fields to new skb in A-050385 workaround Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 27/46] net/x25: prevent a couple of overflows Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 28/46] cxgb3: fix error return code in t3_sge_alloc_qset() Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 29/46] net: pasemi: fix error return code in pasemi_mac_open() Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 30/46] vxlan: fix error return code in __vxlan_dev_create() Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 31/46] chelsio/chtls: fix a double free in chtls_setkey() Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 32/46] net: mvpp2: Fix error return code in mvpp2_open() Greg Kroah-Hartman
2020-12-06 11:17 ` Greg Kroah-Hartman [this message]
2020-12-06 11:17 ` [PATCH 5.9 34/46] net: openvswitch: ensure LSE is pullable before reading it Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 35/46] net/sched: act_mpls: " Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 36/46] net/mlx5: DR, Proper handling of unsupported Connect-X6DX SW steering Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 37/46] net/mlx5: Fix wrong address reclaim when command interface is down Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 38/46] net: mlx5e: fix fs_tcp.c build when IPV6 is not enabled Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 39/46] ALSA: usb-audio: US16x08: fix value count for level meters Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 40/46] Input: xpad - support Ardwiino Controllers Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 41/46] Input: i8042 - add ByteSpeed touchpad to noloop table Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 42/46] Input: atmel_mxt_ts - fix lost interrupts Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 43/46] tracing: Fix alignment of static buffer Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 44/46] tracing: Remove WARN_ON in start_thread() Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 45/46] uapi: fix statx attribute value overlap for DAX & MOUNT_ROOT Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 46/46] drm/i915/gt: Fixup tgl mocs for PTE tracking Greg Kroah-Hartman
2020-12-06 21:08 ` [PATCH 5.9 00/46] 5.9.13-rc1 review Jeffrin Jose T
2020-12-07 7:17 ` Naresh Kamboju
2020-12-08 9:42 ` Greg Kroah-Hartman
2020-12-07 15:04 ` Jon Hunter
2020-12-08 9:43 ` Greg Kroah-Hartman
2020-12-07 15:55 ` Guenter Roeck
2020-12-08 9:43 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201206111558.052432033@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=dcaratti@redhat.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marcelo.leitner@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).