Received: by 2002:a05:6a10:f347:0:0:0:0 with SMTP id d7csp1678857pxu; Sun, 6 Dec 2020 03:48:25 -0800 (PST) X-Google-Smtp-Source: ABdhPJzYFNRxKkNcvCpzaIsowf/5S87+CadiE/w2L9vmEzXFeALzIIvZ/NsFRm4Rem/ubtMZw17S X-Received: by 2002:a17:906:2e16:: with SMTP id n22mr15201370eji.477.1607255304808; Sun, 06 Dec 2020 03:48:24 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1607255304; cv=none; d=google.com; s=arc-20160816; b=kV+4docX+hrz6J+1QejiLmoa9P0EfM4z6f8APFra6mMKp/ORzgnecbzfjgAWQKwOlp mCM6ocqu3o4FXodTr3h92wSv4o8QwyMLx9XoXIFFmGjxXJijYvV06j7Qe+yVtobqH/5q TJRcjwxI3spU2S/pXS9fYg4Q2quYV9qG1zpKi9sse5uSNZINIjYU87S19ZabD2tAfvNR s7RzKpzdwQotm4mAJwq+K5VPlj3kzA7EWl/KoL+v0tCvi+6n2uQT9XnWtUwUIWXtXyot w3bml4O/bKpiNvFyUMxOapctS+mOLMWvbWEhRgyIblNw6ct3MSa9+ybSALHdpZd5lsbN RqvQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from; bh=0Hjn7nKo94YaOy41W4OFD4yNheHyofpH4pUZ+SxEa80=; b=kc+O16tFiT1LlVxWoJrQeF1RHOBxlz+SeG3QkLB2YSPyqLDQ2fCesRna5MOkJ3PMVW 42RRk8eUTSyF/p6plkrfrA9tOqXSFNNybl7H1RFhf6H0NeaT7sr0J1sw69JOC6OKZsJG jzwXSQlREmr+55hPQLWx7mHB6/ZC8kps2b9InsdzWhjQs2W/5Gg6x150u4HrraR4NYz0 6QmGfYKe3Zy3EJlTtOa1YNuFquvuluCDQaYl19NeL0qq8CeerBbrpX8NAsxXG9KmT3At 95S3rF0fdGVG0O29NOjT/YgigSdMFhPlfxTK0w8PijKwCqQEPwYGKQiZeGT1Ck9pkpCg j3+g== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id l2si6379432edf.467.2020.12.06.03.48.02; Sun, 06 Dec 2020 03:48:24 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728690AbgLFLqq (ORCPT + 99 others); Sun, 6 Dec 2020 06:46:46 -0500 Received: from mail.kernel.org ([198.145.29.99]:43936 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729400AbgLFLor (ORCPT ); Sun, 6 Dec 2020 06:44:47 -0500 From: Greg Kroah-Hartman Authentication-Results: mail.kernel.org; dkim=permerror (bad message/signature format) To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marcelo Ricardo Leitner , Davide Caratti , Jakub Kicinski Subject: [PATCH 5.9 33/46] net: skbuff: ensure LSE is pullable before decrementing the MPLS ttl Date: Sun, 6 Dec 2020 12:17:41 +0100 Message-Id: <20201206111558.052432033@linuxfoundation.org> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20201206111556.455533723@linuxfoundation.org> References: <20201206111556.455533723@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Davide Caratti [ Upstream commit 13de4ed9e3a9ccbe54d05f7d5c773f69ecaf6c64 ] skb_mpls_dec_ttl() reads the LSE without ensuring that it is contained in the skb "linear" area. Fix this calling pskb_may_pull() before reading the current ttl. Found by code inspection. Fixes: 2a2ea50870ba ("net: sched: add mpls manipulation actions to TC") Reported-by: Marcelo Ricardo Leitner Signed-off-by: Davide Caratti Link: https://lore.kernel.org/r/53659f28be8bc336c113b5254dc637cc76bbae91.1606987074.git.dcaratti@redhat.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/core/skbuff.c | 3 +++ 1 file changed, 3 insertions(+) --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -5725,6 +5725,9 @@ int skb_mpls_dec_ttl(struct sk_buff *skb if (unlikely(!eth_p_mpls(skb->protocol))) return -EINVAL; + if (!pskb_may_pull(skb, skb_network_offset(skb) + MPLS_HLEN)) + return -ENOMEM; + lse = be32_to_cpu(mpls_hdr(skb)->label_stack_entry); ttl = (lse & MPLS_LS_TTL_MASK) >> MPLS_LS_TTL_SHIFT; if (!--ttl)