Received: by 2002:a25:4158:0:0:0:0:0 with SMTP id o85csp2461861yba; Mon, 15 Apr 2019 12:08:44 -0700 (PDT) X-Google-Smtp-Source: APXvYqxGYEI78EVJJgB6DLNflSmemVtLsqbUjgn4/Eu7f6B2xeIvioR8GuP1TBbj5r+iRMl+HErj X-Received: by 2002:a65:5183:: with SMTP id h3mr71868127pgq.53.1555355323934; Mon, 15 Apr 2019 12:08:43 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1555355323; cv=none; d=google.com; s=arc-20160816; b=ivctkkVzrQWoEHn4Qd5Vq9z3d/YIXtdx7hy3mt70R4UrA2MRQ5ZnpM5ORsW1reHMsZ FLLbXhXVhJHXDH+fAbEh285c+7P8uzXEjgqQFinHyh5rQDutqds42J1VjJhG/fxJT9PZ rI1N+qwRwR+6Rf9Sl8bc6t89Hfn72+BVTWpdXQO9QSLFtM9EPuaIfvors8cOyYzRso/h 1AlBaimsCtcZ6Z7oqND67GnNm22EocejUgQLNb5IjiwWq/j5FVYCl+P1egK1o2r+MK3P KKeZTorL7zpTyarjCd5rLaqFvCuH85Ntss39T68Q4HIUvtbV7zwix81OihuwgbI/ZYzf Au9Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=G/T0uCEgR/I/D3C/aeEsSN0KiEBrDfbOH2xuhAsDFIk=; b=q5/gIwV1mYKe+82z1ggNZhbE+P6HxRFbhXoP0ATeMjRU8YP4pQBw9IsugGrFUFRozP o3+hkTHgRu8xp12qUxCEeAck8zQnzmoB3WHjvMcgJ1zLPy0/7f/6djRVDxf1XKCsWIGR DlzYDl6P9NfQV4FxM5M/2kN+HG4UuBvpKvDkWbxtyyQFjR9ITRyQU/Llvobc8saxDBeU vVjDc/kurbeQMzh0YEyG+NythDpbSunh4vpm/3hr8YGeSnyifEbsMb2T+xWxb0hDnAkU HIKh7XF34xW3b9VbbvCIhhazgxo8XnR8/RzWTf84kwKwWZkcMOQ3vWSJT+jZcU3Af8JP zRQA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="H8HI/W70"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id z20si43384660pgu.43.2019.04.15.12.08.27; Mon, 15 Apr 2019 12:08:43 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="H8HI/W70"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729815AbfDOTF6 (ORCPT + 99 others); Mon, 15 Apr 2019 15:05:58 -0400 Received: from mail.kernel.org ([198.145.29.99]:40008 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729027AbfDOTF5 (ORCPT ); Mon, 15 Apr 2019 15:05:57 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 4830E2087C; Mon, 15 Apr 2019 19:05:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1555355156; bh=yn1LK3m567nBeafdoqjkAvH6rfZibeD6voIWHAzPyB4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=H8HI/W70WHWc1chdSVGGcL2N86T3wiOxlcISZLdSe1GDI/DvJDL4ntldj+wQmXscU JV93KqSdz9u/jJIbNiBg0e7UQ2IJWG9JcYC8i1Cetl1o41S7RwIzY90+nHgHBHaH/G sHwA1+YNTjaJ8T2sIv0GHNWWAPemVLTG/rZjimzg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andrea Righi , Pravin B Shelar , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 017/101] openvswitch: fix flow actions reallocation Date: Mon, 15 Apr 2019 20:58:15 +0200 Message-Id: <20190415183741.278608168@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190415183740.341577907@linuxfoundation.org> References: <20190415183740.341577907@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org [ Upstream commit f28cd2af22a0c134e4aa1c64a70f70d815d473fb ] The flow action buffer can be resized if it's not big enough to contain all the requested flow actions. However, this resize doesn't take into account the new requested size, the buffer is only increased by a factor of 2x. This might be not enough to contain the new data, causing a buffer overflow, for example: [ 42.044472] ============================================================================= [ 42.045608] BUG kmalloc-96 (Not tainted): Redzone overwritten [ 42.046415] ----------------------------------------------------------------------------- [ 42.047715] Disabling lock debugging due to kernel taint [ 42.047716] INFO: 0x8bf2c4a5-0x720c0928. First byte 0x0 instead of 0xcc [ 42.048677] INFO: Slab 0xbc6d2040 objects=29 used=18 fp=0xdc07dec4 flags=0x2808101 [ 42.049743] INFO: Object 0xd53a3464 @offset=2528 fp=0xccdcdebb [ 42.050747] Redzone 76f1b237: cc cc cc cc cc cc cc cc ........ [ 42.051839] Object d53a3464: 6b 6b 6b 6b 6b 6b 6b 6b 0c 00 00 00 6c 00 00 00 kkkkkkkk....l... [ 42.053015] Object f49a30cc: 6c 00 0c 00 00 00 00 00 00 00 00 03 78 a3 15 f6 l...........x... [ 42.054203] Object acfe4220: 20 00 02 00 ff ff ff ff 00 00 00 00 00 00 00 00 ............... [ 42.055370] Object 21024e91: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 42.056541] Object 070e04c3: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 42.057797] Object 948a777a: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 42.059061] Redzone 8bf2c4a5: 00 00 00 00 .... [ 42.060189] Padding a681b46e: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ Fix by making sure the new buffer is properly resized to contain all the requested data. BugLink: https://bugs.launchpad.net/bugs/1813244 Signed-off-by: Andrea Righi Acked-by: Pravin B Shelar Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- net/openvswitch/flow_netlink.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c index c7b6010b2c09..eab5e8eaddaa 100644 --- a/net/openvswitch/flow_netlink.c +++ b/net/openvswitch/flow_netlink.c @@ -2306,14 +2306,14 @@ static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa, struct sw_flow_actions *acts; int new_acts_size; - int req_size = NLA_ALIGN(attr_len); + size_t req_size = NLA_ALIGN(attr_len); int next_offset = offsetof(struct sw_flow_actions, actions) + (*sfa)->actions_len; if (req_size <= (ksize(*sfa) - next_offset)) goto out; - new_acts_size = ksize(*sfa) * 2; + new_acts_size = max(next_offset + req_size, ksize(*sfa) * 2); if (new_acts_size > MAX_ACTIONS_BUFSIZE) { if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size) { -- 2.19.1