lkml.org 
[lkml]   [2020]   [Aug]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 40/48] openvswitch: Prevent kernel-infoleak in ovs_ct_put_key()
    Date
    From: Peilin Ye <yepeilin.cs@gmail.com>

    [ Upstream commit 9aba6c5b49254d5bee927d81593ed4429e91d4ae ]

    ovs_ct_put_key() is potentially copying uninitialized kernel stack memory
    into socket buffers, since the compiler may leave a 3-byte hole at the end
    of `struct ovs_key_ct_tuple_ipv4` and `struct ovs_key_ct_tuple_ipv6`. Fix
    it by initializing `orig` with memset().

    Fixes: 9dd7f8907c37 ("openvswitch: Add original direction conntrack tuple to sw_flow_key.")
    Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/openvswitch/conntrack.c | 38 ++++++++++++++++++++------------------
    1 file changed, 20 insertions(+), 18 deletions(-)

    --- a/net/openvswitch/conntrack.c
    +++ b/net/openvswitch/conntrack.c
    @@ -283,10 +283,6 @@ void ovs_ct_fill_key(const struct sk_buf
    ovs_ct_update_key(skb, NULL, key, false, false);
    }

    -#define IN6_ADDR_INITIALIZER(ADDR) \
    - { (ADDR).s6_addr32[0], (ADDR).s6_addr32[1], \
    - (ADDR).s6_addr32[2], (ADDR).s6_addr32[3] }
    -
    int ovs_ct_put_key(const struct sw_flow_key *swkey,
    const struct sw_flow_key *output, struct sk_buff *skb)
    {
    @@ -308,24 +304,30 @@ int ovs_ct_put_key(const struct sw_flow_

    if (swkey->ct_orig_proto) {
    if (swkey->eth.type == htons(ETH_P_IP)) {
    - struct ovs_key_ct_tuple_ipv4 orig = {
    - output->ipv4.ct_orig.src,
    - output->ipv4.ct_orig.dst,
    - output->ct.orig_tp.src,
    - output->ct.orig_tp.dst,
    - output->ct_orig_proto,
    - };
    + struct ovs_key_ct_tuple_ipv4 orig;
    +
    + memset(&orig, 0, sizeof(orig));
    + orig.ipv4_src = output->ipv4.ct_orig.src;
    + orig.ipv4_dst = output->ipv4.ct_orig.dst;
    + orig.src_port = output->ct.orig_tp.src;
    + orig.dst_port = output->ct.orig_tp.dst;
    + orig.ipv4_proto = output->ct_orig_proto;
    +
    if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4,
    sizeof(orig), &orig))
    return -EMSGSIZE;
    } else if (swkey->eth.type == htons(ETH_P_IPV6)) {
    - struct ovs_key_ct_tuple_ipv6 orig = {
    - IN6_ADDR_INITIALIZER(output->ipv6.ct_orig.src),
    - IN6_ADDR_INITIALIZER(output->ipv6.ct_orig.dst),
    - output->ct.orig_tp.src,
    - output->ct.orig_tp.dst,
    - output->ct_orig_proto,
    - };
    + struct ovs_key_ct_tuple_ipv6 orig;
    +
    + memset(&orig, 0, sizeof(orig));
    + memcpy(orig.ipv6_src, output->ipv6.ct_orig.src.s6_addr32,
    + sizeof(orig.ipv6_src));
    + memcpy(orig.ipv6_dst, output->ipv6.ct_orig.dst.s6_addr32,
    + sizeof(orig.ipv6_dst));
    + orig.src_port = output->ct.orig_tp.src;
    + orig.dst_port = output->ct.orig_tp.dst;
    + orig.ipv6_proto = output->ct_orig_proto;
    +
    if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6,
    sizeof(orig), &orig))
    return -EMSGSIZE;

    \
     
     \ /
      Last update: 2022-09-17 16:08    [W:2.314 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site