lkml.org 
[lkml]   [2020]   [Apr]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 207/245] net_sched: fix datalen for ematch
    3.16.83-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Cong Wang <xiyou.wangcong@gmail.com>

    commit 61678d28d4a45ef376f5d02a839cc37509ae9281 upstream.

    syzbot reported an out-of-bound access in em_nbyte. As initially
    analyzed by Eric, this is because em_nbyte sets its own em->datalen
    in em_nbyte_change() other than the one specified by user, but this
    value gets overwritten later by its caller tcf_em_validate().
    We should leave em->datalen untouched to respect their choices.

    I audit all the in-tree ematch users, all of those implement
    ->change() set em->datalen, so we can just avoid setting it twice
    in this case.

    Reported-and-tested-by: syzbot+5af9a90dad568aa9f611@syzkaller.appspotmail.com
    Reported-by: syzbot+2f07903a5b05e7f36410@syzkaller.appspotmail.com
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Cc: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    [bwh: Backported to 3.16: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    net/sched/ematch.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/net/sched/ematch.c
    +++ b/net/sched/ematch.c
    @@ -266,12 +266,12 @@ static int tcf_em_validate(struct tcf_pr
    }
    em->data = (unsigned long) v;
    }
    + em->datalen = data_len;
    }
    }

    em->matchid = em_hdr->matchid;
    em->flags = em_hdr->flags;
    - em->datalen = data_len;

    err = 0;
    errout:
    \
     
     \ /
      Last update: 2020-04-24 01:11    [W:2.147 / U:0.220 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site