From patchwork Wed Sep 27 02:02:19 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Joao Moreira X-Patchwork-Id: 14562 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:cae8:0:b0:403:3b70:6f57 with SMTP id r8csp2336230vqu; Tue, 26 Sep 2023 19:39:44 -0700 (PDT) X-Google-Smtp-Source: AGHT+IEzGxbTBhfVRfZzPahEkr+r5wFFVJ92KANnB454l4uoly9iOgqDNc3FXsLeUnbwcCJVIN5J X-Received: by 2002:a05:6358:94a4:b0:13c:fd78:bb43 with SMTP id i36-20020a05635894a400b0013cfd78bb43mr920657rwb.27.1695782384380; Tue, 26 Sep 2023 19:39:44 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1695782384; cv=none; d=google.com; s=arc-20160816; b=HoLi5li9C0uMYZ3VQilop1fNVFinHzjS9VAl0XtEMiOl3V9wbOStqRb28amTrdqdsv DdtzxGiKxDNwn+6bRjp7363BURCYEq+EECXYGyPXfUvslYy2rIAWFdsiAAkieKEhx9w6 V0P5uaKB/I4YRTvA8o6iOGNn9ksRzuVb3w3h7biyQVmw0gGCuQagwxDF+BDvkVQFkieN zME3UcE3M0CHTwkvuMiWYB4YBNCf2bKUPzxkDZX0MM1Z7jdB570MAXGr7iSmK3PYPSY+ KO8VavuVtfTeMxIx+WTqc6rWZCYk2Nysx9uQ0WYzZ1vX6uN9ftSnhYhizKNca+twR5ap Xj5g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=BECYdLMr1wBb4zAkdQz8RuMU4pvnMnldMiTtVFXggh8=; fh=BI+T4F8SA0SHDb6m7HWfv63JWeI34VTzFV+4LHBcWNU=; b=f/03vsQxRUK8IX7KAsXrosV+Bf1kfxpOQPq2At48MGJrh5sdUgWI2754sVSaRAHkMI sJqFZkil+k6yZoPHz9ei4OqVyhIQ2eXLqW9P1+Xv7GHRnHgGbBwM2q8rRtuVGUq/BoFg +S/TQHOTtYRdelL3NzZ1LgSvfpqUwGLB35WyjBGv0wHMDv699O0SlFp+ps6khcavc68G Ey3QbGWcDRFmJX+F1Ve+Eru7veghw6Jq0iib1LllDP/RSu0Z8mhzMAJ5YEiS2GlPbup3 ZPn9G3IjyhZjq8qICSA1XS3HlUpk2H9YusyN8JjtcJ3Htosj0I7hUCMvoGIfHA8/Ty6z sxfw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from snail.vger.email (snail.vger.email. [2620:137:e000::3:7]) by mx.google.com with ESMTPS id h2-20020a056a00230200b0068e390d86b4si15111297pfh.133.2023.09.26.19.39.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 26 Sep 2023 19:39:44 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) client-ip=2620:137:e000::3:7; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by snail.vger.email (Postfix) with ESMTP id A3A11801B9CD; Tue, 26 Sep 2023 19:39:43 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at snail.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231859AbjI0Cjk (ORCPT + 28 others); Tue, 26 Sep 2023 22:39:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53464 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229993AbjI0Chj (ORCPT ); Tue, 26 Sep 2023 22:37:39 -0400 Received: from mgamail.intel.com (mgamail.intel.com [134.134.136.65]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 759641C26A; Tue, 26 Sep 2023 19:02:54 -0700 (PDT) X-IronPort-AV: E=McAfee;i="6600,9927,10845"; a="385565329" X-IronPort-AV: E=Sophos;i="6.03,179,1694761200"; d="scan'208";a="385565329" Received: from orsmga006.jf.intel.com ([10.7.209.51]) by orsmga103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 Sep 2023 19:02:38 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10845"; a="725628814" X-IronPort-AV: E=Sophos;i="6.03,179,1694761200"; d="scan'208";a="725628814" Received: from pinksteam.jf.intel.com ([10.165.239.231]) by orsmga006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 Sep 2023 19:02:37 -0700 From: joao@overdrivepizza.com To: pablo@netfilter.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, joao@overdrivepizza.com Cc: kadlec@netfilter.org, fw@strlen.de, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, rkannoth@marvell.com, wojciech.drewek@intel.com, steen.hegenlund@microhip.com, keescook@chromium.org, Joao Moreira Subject: [PATCH v2 0/2] Prevent potential write out of bounds Date: Tue, 26 Sep 2023 19:02:19 -0700 Message-ID: <20230927020221.85292-1-joao@overdrivepizza.com> X-Mailer: git-send-email 2.42.0 MIME-Version: 1.0 X-Spam-Status: No, score=-3.4 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_NEUTRAL autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (snail.vger.email [0.0.0.0]); Tue, 26 Sep 2023 19:39:43 -0700 (PDT) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1778156709388946140 X-GMAIL-MSGID: 1778156709388946140 From: Joao Moreira The function flow_rule_alloc in net/core/flow_offload.c [2] gets an unsigned int num_actions (line 10) and later traverses the actions in the rule (line 24) setting hw.stats to FLOW_ACTION_HW_STATS_DONT_CARE. Within the same file, the loop in the line 24 compares a signed int (i) to an unsigned int (num_actions), and then uses i as an array index. If an integer overflow happens, then the array within the loop is wrongly indexed, causing a write out of bounds. After checking with maintainers, it seems that the front-end caps the maximum value of num_action, thus it is not possible to reach the given write out of bounds, yet, still, to prevent disasters it is better to fix the signedness here. Similarly, also it is also good to ensure that an overflow won't happen in net/netfilter/nf_tables_offload.c's function nft_flow_rule_create by making the variable unsigned and ensuring that it returns an error if its value reaches UINT_MAX. This issue was observed by the commit author while reviewing a write-up regarding a CVE within the same subsystem [1]. 1 - https://nickgregory.me/post/2022/03/12/cve-2022-25636/ Tks, Joao Moreira (2): Make loop indexes unsigned Make num_actions unsigned net/core/flow_offload.c | 4 ++-- net/netfilter/nf_tables_offload.c | 6 +++++- 2 files changed, 7 insertions(+), 3 deletions(-)