Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 31 May 2023 17:26:50 +0200
From:   Simon Horman <simon.horman@corigine.com>
To:     Hangyu Hua <hbh25y@gmail.com>
Cc:     jhs@mojatatu.com, xiyou.wangcong@gmail.com, jiri@resnulli.us,
        davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
        pabeni@redhat.com, pieter.jansen-van-vuuren@amd.com,
        netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH net v2] net/sched: flower: fix possible OOB write in
 fl_set_geneve_opt()
Message-ID: <ZHdnOnDaWYPEzQ/m@corigine.com>
References: <20230531102805.27090-1-hbh25y@gmail.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230531102805.27090-1-hbh25y@gmail.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?rVz9dFJphUGYhiwKycaT9V/rb9iaEiArXDAhVpxIEjTKM35mNHcaRfxF7mEM?=
 =?us-ascii?Q?S7Drhr5QdgOWYizSjnIju1L2zUgv1BJVmo0NrFNqX9DyZE/zPy5VtOWDmecO?=
 =?us-ascii?Q?VBUKBrZF0ChVil/n86X0hzO84n61G1Bv8flPy7md6QDxSIVC480kHxImq4rg?=
 =?us-ascii?Q?BtvdjaNorm5+5dw5GGFyFl0FqvVteU++TEYrJFPJvob1/7MNuoN26rd5pXWV?=
 =?us-ascii?Q?B+xU7Q0COKazjlaTIQkaZoD/C8au+OTkOZP3nim1kq62WbPfQ+B4Dng5AASB?=
 =?us-ascii?Q?p8uJZlxJ+o5cLObVOo9t3YKIR+4rxeBiareUdENYYjOSmEQiYPvmrl3Xsqjq?=
 =?us-ascii?Q?9Gc/Ef7f7gFjb3+1tUKtLgBjYKuoLHxryCbqHVvViUQU/Aubf3VlUxTjwR7y?=
 =?us-ascii?Q?5uxK4jqsMiV4SWSDJQ/p+ahFEnucV3gxpm0UzwJUdxGMYGuTkVFCCkNeK4pZ?=
 =?us-ascii?Q?B3y9HjHzMOuD15kt/pl9e4tssiY4x1p6q20SxhHZlsg5THceRrmEVihXQ46m?=
 =?us-ascii?Q?hqT4LdGSc0RVs7kqo/yz+zE4iUqOghAasoHeKV1v5pwWVaypDA8IjDbHFVvC?=
 =?us-ascii?Q?ATDgqCB9iHxugRJw0Qqsem4MTUuGja89I5f85fnrzlnzrK0/AiuaGVH3XuX+?=
 =?us-ascii?Q?ffAyHc/wbZtoiUWUbam+u40gHuC8Z3O628JWDjsFiNbGWAmeiyY2L3F0qq/g?=
 =?us-ascii?Q?eHYXse/vbklttzcZmU0t1CgefHDQifyd5ICAecs2CmqeRtG1NQAif8y9QDEL?=
 =?us-ascii?Q?RIzxFmhQxx1WxrUqbzpUmYR32r/xBWssaDqnGj0ypFJOY7vpHVB5+g930Lqc?=
 =?us-ascii?Q?Xl2U6W/pjLyMcA9o3D9ErnFQZERB37DwhQT5nwLTBafK382PLCcHj5jwXJlA?=
 =?us-ascii?Q?xWjH1I+DjuWM70AqJM0R2KLcZ11CqnlEHGEEwNO3UqomFqND+nEnu/bvLJMO?=
 =?us-ascii?Q?+/uT+nOqqipSNgODP1t4DUzw4VBjZeO/YUCXoirtuQl2boZVW0ub5OpM7++b?=
 =?us-ascii?Q?SDU6hHjtseK/ztb+sr8DYCDuf4depVl7k/5cEYu3rVLAxCjOxKbhWRlkRHqC?=
 =?us-ascii?Q?mxbGM79vayc1bqiLEDDOk+aBgXG6RfaHt58CcwimjD3LGGSjJioHqWxphif/?=
 =?us-ascii?Q?4Fu9Im9zSJQ0xKvX5cBxoKYQzE/1fCQG9GgLKWPmaEyL/s2XR238QM0qRRoS?=
 =?us-ascii?Q?DwOEX79kr2nPSr0VzIRINoQqmC7dtmhznwRtDFzc0fDeZqutN5sCOilhxR5D?=
 =?us-ascii?Q?OYKKHBJjo0QZ0iUez9SopGFgavt7WmrRgDyEZiftcdHGWaYiNVOktt+PHccy?=
 =?us-ascii?Q?IVJV1VcsQvSYfMrEUQa/u5P0vdW31Ffpkcnrxf6Chta8YhCoJMjmm2Q06q4q?=
 =?us-ascii?Q?9SoiHNDWmbNqTf3SXKOQS4AM9vvHuLavdLGq21uxDM4U6hmjAfzpS3tGuNnG?=
 =?us-ascii?Q?wxyBE3JKAVUzQsHMNqu602rQ7+wOxzulJlneb9G5VJUrcKHkTuDtYh8ygSE1?=
 =?us-ascii?Q?cX3uOliGagEIfIDDq0hEmXUlkaKuWAligIGaE1MUOBtnUtOENX7PSgsd62yG?=
 =?us-ascii?Q?VZ2TDz1GOGhvMR4IHTeYpeN/nDNHmZ1L3lxH1E8Txgeiv4d1BysB15t1aS19?=
 =?us-ascii?Q?X59PBHank6Ns3409jPFC1yI1Qd+zKV4nsZBJhD/z1LIiixBv3qY8rYUMvog+?=
 =?us-ascii?Q?NoKUVg=3D=3D?=
X-OriginatorOrg: corigine.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 7031f1d0-c572-4341-2808-08db61eb7843
X-MS-Exchange-CrossTenant-AuthSource: PH0PR13MB4842.namprd13.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 May 2023 15:26:56.7355
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: fe128f2c-073b-4c20-818e-7246a585940c
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 9r6ji3HPMgZVpx6GMQ9rL7pE8pGGuGbwCfGdYnMBFEn670bvM+S+/5O2ta7IVm2lc4MOiW5srjHQR9uDWvE8HrtZtUYZIuHGEq18EOplN3E=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR13MB6534
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Wed, May 31, 2023 at 06:28:04PM +0800, Hangyu Hua wrote:
> If we send two TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets and their total
> size is 252 bytes(key->enc_opts.len = 252) then
> key->enc_opts.len = opt->length = data_len / 4 = 0 when the third
> TCA_FLOWER_KEY_ENC_OPTS_GENEVE packet enters fl_set_geneve_opt. This
> bypasses the next bounds check and results in an out-of-bounds.
> 
> Fixes: 0a6e77784f49 ("net/sched: allow flower to match tunnel options")
> Signed-off-by: Hangyu Hua <hbh25y@gmail.com>

Reviewed-by: Simon Horman <simon.horman@corigine.com>