Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 30 May 2023 13:36:59 +0200
From:   Simon Horman <simon.horman@corigine.com>
To:     Hangyu Hua <hbh25y@gmail.com>
Cc:     jhs@mojatatu.com, xiyou.wangcong@gmail.com, jiri@resnulli.us,
        davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
        pabeni@redhat.com, simon.horman@netronome.com,
        pieter.jansen-van-vuuren@amd.com, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH] net: sched: fix possible OOB write in fl_set_geneve_opt()
Message-ID: <ZHXf29es/yh3r6jq@corigine.com>
References: <20230529043615.4761-1-hbh25y@gmail.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230529043615.4761-1-hbh25y@gmail.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?DTZ9mKnAjhBQmVSQAcxCtr/RDeoqLXKnKSKuAPUN8LU1vK8BDsjMhmdoHFX1?=
 =?us-ascii?Q?nkK/kG5/Ujjt9dR20q0PvDR2dnMxXX+rynHt7vXs8hEiHWftUp4Qju0xm6kM?=
 =?us-ascii?Q?odxPcJFW+N/RhMCYShLAe8uiV+Ye22upSJDr/gOUxVWpawb8YhLVzxvyTKiR?=
 =?us-ascii?Q?RbK1P5yRa9EwLH8ZkAca0jK2IK/GpFi2ZaFgKLzg55QsBrVe/0yznNv843ug?=
 =?us-ascii?Q?7SDHIjFbDxHAjQRvQ09vayKfdS7xnWxP57GPa5TOFJtHux0G58kj1IyhBJoY?=
 =?us-ascii?Q?5bESdfjCIxCd27IEU1qiSdwbS/wVonhoOa+YTRpni576gMxvD3RHXfLBlAIR?=
 =?us-ascii?Q?95m5trwnYkbTz5HaIw6r7ap3Dc+5H71q++33Y/eqFOwHxvtuvvH/RJGdwPtW?=
 =?us-ascii?Q?+3i9mgBgGBj3RZBqfuLEaBwYG8UsMM3e1ATKz2/Uu4DB/QN5p+KtTfvaDszF?=
 =?us-ascii?Q?1IF9C7PDtM8pv/Q3mUnYRYughYfeicl3hR5357kuA63UfTx2J1etSo+57+Nx?=
 =?us-ascii?Q?mkyWZ2pEUpugtmbYh0SITCE5MQ4PDbw0vA0HDnzMaxBrT3zGM8pb+uohyEL/?=
 =?us-ascii?Q?k3xenjP7uZBL1R/GIBW4XdwiXniaODBTkxtCi7CtHmdTOxG+Q/rMRdkPjFgz?=
 =?us-ascii?Q?7R/KdY8ysKLYOBhP4ors0EzJMTelhsHwgiTYOXanW0/+EQuRgGzYQjrl6OG5?=
 =?us-ascii?Q?kdn7aHuE1PkTs64Oe+oDRAVmYKFl8KFHg/2adXY84S+g+1DY4rW8R+CR+B6p?=
 =?us-ascii?Q?5V4NlT7qKXS3clIJLVNl7FLJ0VHsnKBDiL+SSfKmldPtgwefVQ88c/zuzSSX?=
 =?us-ascii?Q?a0qF7EdQiOd4JAny0666P6PB33ybD27UA9rptVDBLD1j8PRvlL+rlV+7s8qC?=
 =?us-ascii?Q?5H7/Ng2ALNZr5djV3bhjWvDCi1lWsXpofjnGECe73TzWfmyatQ8GKIbdcS55?=
 =?us-ascii?Q?omniqFV5efd/d/g2arubcb9V6cn3HfHJM9k38yBrrhmsgcEoYeKSLRkQVwDK?=
 =?us-ascii?Q?ABUnWbnZfwAke3tgIYUr1AsKaM1mfiBePOGaYAMnOccdbzxVJkdoolasRpvj?=
 =?us-ascii?Q?28hWhSDLuyNvaRvIgubra6glZcYvuqhB6c1foCZZ0v+EmzcGd3P9knDzDMMH?=
 =?us-ascii?Q?jJV7P7wQcKVPAoWLb1XeyOVvr47fYNTvraTp0sHteymcCzk83V2e/K3Wextz?=
 =?us-ascii?Q?L12y8yZxOiI12NVJBUp2sD+jTlFL6wq51MOJ0w1LUFZiBKwV3lAQcOdlHeLu?=
 =?us-ascii?Q?HRGAzmIhTat5559IBRVWbDzNFg7TwLlSk7bOFRjUCMXj4kh2eCP9UVL+DyTx?=
 =?us-ascii?Q?UK+ba0ArMwJoPjeDx1z1E/AdWuPlqmBPBzlCiqxjndKt42IpnRkqeIGkYjHu?=
 =?us-ascii?Q?pVPWonMMtS0/eZc0fVdFUm1zSk1m4A2WV5MxlrEb8X/9IkkVSE4CvXwFoQT9?=
 =?us-ascii?Q?QODXlNJhSZYEW/zvVYeCpiaBwGM/4hswg1QQuui1iqD403uZ8WM07WlXWjEt?=
 =?us-ascii?Q?hDAHwa29ikUFx/eQYA9+CCktXQOiRwoN7Q+tS1tPtP9Fak8ONOAJ5Dn9EFEM?=
 =?us-ascii?Q?tf8VceluEI25Q++SBmCZRrxhn5oGhSadsml86GAmS+SqCZklJkx6queE1F4N?=
 =?us-ascii?Q?ERc31vA1M8DevK+WOxO0cepoYbreVrJIg2MZxxdhxjwyeoSCGZPbaIEgwqT0?=
 =?us-ascii?Q?QEaJyw=3D=3D?=
X-OriginatorOrg: corigine.com
X-MS-Exchange-CrossTenant-Network-Message-Id: a3d22713-aaa8-4fcd-0557-08db610231e7
X-MS-Exchange-CrossTenant-AuthSource: PH0PR13MB4842.namprd13.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 May 2023 11:37:06.3087
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: fe128f2c-073b-4c20-818e-7246a585940c
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: DD8mbsCJ/FeUP/LBnWxQeRohf39i90AybplzDaYv99aQF/4eT/0+POlY4eD5CEAI0u4giCyisjTvmvd4PVrTxpnmOlVpq7OmaGV+6w53Vow=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN4PR13MB5711
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

[Updated Pieter's email address, dropped old email address of mine]

On Mon, May 29, 2023 at 12:36:15PM +0800, Hangyu Hua wrote:
> If we send two TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets and their total
> size is 252 bytes(key->enc_opts.len = 252) then
> key->enc_opts.len = opt->length = data_len / 4 = 0 when the third
> TCA_FLOWER_KEY_ENC_OPTS_GENEVE packet enters fl_set_geneve_opt. This
> bypasses the next bounds check and results in an out-of-bounds.
> 
> Fixes: 0a6e77784f49 ("net/sched: allow flower to match tunnel options")
> Signed-off-by: Hangyu Hua <hbh25y@gmail.com>

Hi Hangyu Hua,

Thanks. I think I see the problem too.
But I do wonder, is this more general than Geneve options?
That is, can this occur with any sequence of options, that
consume space in enc_opts (configured in fl_set_key()) that
in total are more than 256 bytes?

> ---
>  net/sched/cls_flower.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
> index e960a46b0520..a326fbfe4339 100644
> --- a/net/sched/cls_flower.c
> +++ b/net/sched/cls_flower.c
> @@ -1153,6 +1153,9 @@ static int fl_set_geneve_opt(const struct nlattr *nla, struct fl_flow_key *key,
>  	if (option_len > sizeof(struct geneve_opt))
>  		data_len = option_len - sizeof(struct geneve_opt);
>  
> +	if (key->enc_opts.len > FLOW_DIS_TUN_OPTS_MAX - 4)
> +		return -ERANGE;
> +
>  	opt = (struct geneve_opt *)&key->enc_opts.data[key->enc_opts.len];
>  	memset(opt, 0xff, option_len);
>  	opt->length = data_len / 4;
> -- 
> 2.34.1
> 
>