luck/tmp_suning_uos_patched
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity
ffc8d61387
tmp_suning_uos_patched/net/openvswitch
History
Paolo Valerio 0837ff17d0 openvswitch: fix OOB access in reserve_sfa_size() 
commit cefa91b2332d7009bc0be5d951d6cbbf349f90f8 upstream.

Given a sufficiently large number of actions, while copying and
reserving memory for a new action of a new flow, if next_offset is
greater than MAX_ACTIONS_BUFSIZE, the function reserve_sfa_size() does
not return -EMSGSIZE as expected, but it allocates MAX_ACTIONS_BUFSIZE
bytes increasing actions_len by req_size. This can then lead to an OOB
write access, especially when further actions need to be copied.

Fix it by rearranging the flow action size check.

KASAN splat below:

==================================================================
BUG: KASAN: slab-out-of-bounds in reserve_sfa_size+0x1ba/0x380 [openvswitch]
Write of size 65360 at addr ffff888147e4001c by task handler15/836

CPU: 1 PID: 836 Comm: handler15 Not tainted 5.18.0-rc1+ #27
...
Call Trace:
 <TASK>
 dump_stack_lvl+0x45/0x5a
 print_report.cold+0x5e/0x5db
 ? __lock_text_start+0x8/0x8
 ? reserve_sfa_size+0x1ba/0x380 [openvswitch]
 kasan_report+0xb5/0x130
 ? reserve_sfa_size+0x1ba/0x380 [openvswitch]
 kasan_check_range+0xf5/0x1d0
 memcpy+0x39/0x60
 reserve_sfa_size+0x1ba/0x380 [openvswitch]
 __add_action+0x24/0x120 [openvswitch]
 ovs_nla_add_action+0xe/0x20 [openvswitch]
 ovs_ct_copy_action+0x29d/0x1130 [openvswitch]
 ? __kernel_text_address+0xe/0x30
 ? unwind_get_return_address+0x56/0xa0
 ? create_prof_cpu_mask+0x20/0x20
 ? ovs_ct_verify+0xf0/0xf0 [openvswitch]
 ? prep_compound_page+0x198/0x2a0
 ? __kasan_check_byte+0x10/0x40
 ? kasan_unpoison+0x40/0x70
 ? ksize+0x44/0x60
 ? reserve_sfa_size+0x75/0x380 [openvswitch]
 __ovs_nla_copy_actions+0xc26/0x2070 [openvswitch]
 ? __zone_watermark_ok+0x420/0x420
 ? validate_set.constprop.0+0xc90/0xc90 [openvswitch]
 ? __alloc_pages+0x1a9/0x3e0
 ? __alloc_pages_slowpath.constprop.0+0x1da0/0x1da0
 ? unwind_next_frame+0x991/0x1e40
 ? __mod_node_page_state+0x99/0x120
 ? __mod_lruvec_page_state+0x2e3/0x470
 ? __kasan_kmalloc_large+0x90/0xe0
 ovs_nla_copy_actions+0x1b4/0x2c0 [openvswitch]
 ovs_flow_cmd_new+0x3cd/0xb10 [openvswitch]
 ...

Cc: stable@vger.kernel.org
Fixes: f28cd2af22 ("openvswitch: fix flow actions reallocation")
Signed-off-by: Paolo Valerio <pvalerio@redhat.com>
Acked-by: Eelco Chaudron <echaudro@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-04-27 13:53:55 +02:00
..
actions.c net: openvswitch: don't send internal clone attribute to the userspace. 2022-04-13 21:01:06 +02:00
conntrack.c openvswitch: always update flow key after nat 2022-04-08 14:40:23 +02:00
conntrack.h
datapath.c net: openvswitch: silence suspicious RCU usage warning 2020-11-03 16:57:42 -08:00
datapath.h net: openvswitch: add masks cache hit counter 2020-08-03 15:17:48 -07:00
dp_notify.c
flow_netlink.c openvswitch: fix OOB access in reserve_sfa_size() 2022-04-27 13:53:55 +02:00
flow_netlink.h
flow_table.c net: openvswitch: silence suspicious RCU usage warning 2020-11-03 16:57:42 -08:00
flow_table.h net: openvswitch: fix to make sure flow_lookup() is not preempted 2020-10-18 12:29:36 -07:00
flow.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
flow.h treewide: Use sizeof_field() macro 2019-12-09 10:36:44 -08:00
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile
meter.c openvswitch: meter: fix race when getting now_ms. 2021-06-03 09:00:47 +02:00
meter.h net: openvswitch: use u64 for meter bucket 2020-04-23 18:26:11 -07:00
vport-geneve.c
vport-gre.c
vport-internal_dev.c net: openvswitch: use new function dev_fetch_sw_netstats 2020-10-13 17:33:49 -07:00
vport-internal_dev.h
vport-netdev.c
vport-netdev.h
vport-vxlan.c
vport.c ovs: clear skb->tstamp in forwarding path 2021-08-26 08:35:50 -04:00
vport.h