Messages in this thread | | | Subject | Re: [PATCH net v2] net/sched: flower: fix possible OOB write in fl_set_geneve_opt() | From | patchwork-bot+netdevbpf@kernel ... | Date | Thu, 01 Jun 2023 11:10:19 +0000 |
| |
Hello:
This patch was applied to netdev/net.git (main) by Paolo Abeni <pabeni@redhat.com>:
On Wed, 31 May 2023 18:28:04 +0800 you wrote: > If we send two TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets and their total > size is 252 bytes(key->enc_opts.len = 252) then > key->enc_opts.len = opt->length = data_len / 4 = 0 when the third > TCA_FLOWER_KEY_ENC_OPTS_GENEVE packet enters fl_set_geneve_opt. This > bypasses the next bounds check and results in an out-of-bounds. > > Fixes: 0a6e77784f49 ("net/sched: allow flower to match tunnel options") > Signed-off-by: Hangyu Hua <hbh25y@gmail.com> > > [...]
Here is the summary with links: - [net,v2] net/sched: flower: fix possible OOB write in fl_set_geneve_opt() https://git.kernel.org/netdev/net/c/4d56304e5827
You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
| |