From patchwork Thu Mar 28 06:36:00 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrea Righi X-Patchwork-Id: 1067832 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=canonical.com Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 44VFWC5mmFz9sR3 for ; Thu, 28 Mar 2019 17:36:07 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726342AbfC1GgG (ORCPT ); Thu, 28 Mar 2019 02:36:06 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:54193 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726249AbfC1GgE (ORCPT ); Thu, 28 Mar 2019 02:36:04 -0400 Received: from mail-wr1-f70.google.com ([209.85.221.70]) by youngberry.canonical.com with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.76) (envelope-from ) id 1h9Odu-0005iM-PF for netdev@vger.kernel.org; Thu, 28 Mar 2019 06:36:02 +0000 Received: by mail-wr1-f70.google.com with SMTP id b16so4968145wrq.10 for ; Wed, 27 Mar 2019 23:36:02 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition:user-agent; bh=ZCbQcu+6lIkxzNPMoAuRGk0babrO/Mj266g8UlT9E/s=; b=a2Z+HGxKwmODURfPYFxgC6Tnt+x1rD/miLVLRmmbsAe4JAsjtilLpKYLbHr0C1RqIj uTI02rS7qK74AhLKJcTzxKbAwXKwjk33Vtsm+GaGbY29r3QG+n0KAjigBKaE5K4UIV29 EB1dVwdmZDCghUjOu5tPbxvDI+wQS6L28o2/1Cc7CYzxIocfmE5i1TdlTFEeijjXRCeO Tbar5uM27Twc0va8GezryKgiE+1EvTW1ndUWeNvkmMemXjFlX7Mb3Gtoi4nRWrmy6l99 DPuOzswECmkq8D7uJF4Uxqv7lyTdpSxhfhPabuxFR3WS+OhBDwu2ScMxTDn2nyHGWWwA W0Xg== X-Gm-Message-State: APjAAAX8ADlZknPhbKuYXC7p+J4UrBSLeHmWKXz3Eb6zyr2rt73/DcoN +ZgRGQ2Pqvk+G3CA8n8MYL5wLUZ7FMyLFqtg3V5r4kqHTrai/gCUDJ5ap9B9XcTSgin4Nlsv/Be iuUmjZkw/mPfEoEvqrDNcmA+JrJ8I1SWJFQ== X-Received: by 2002:a05:600c:24f:: with SMTP id 15mr5543189wmj.48.1553754962485; Wed, 27 Mar 2019 23:36:02 -0700 (PDT) X-Google-Smtp-Source: APXvYqy9yTibCKgdZfHvIIBRmSNoR53M8eZ1Wxeg46iykn+/YqtPZxGEax3FM1QAzG9fQH7dGL/NDQ== X-Received: by 2002:a05:600c:24f:: with SMTP id 15mr5543181wmj.48.1553754962259; Wed, 27 Mar 2019 23:36:02 -0700 (PDT) Received: from localhost (host141-127-dynamic.17-87-r.retail.telecomitalia.it. [87.17.127.141]) by smtp.gmail.com with ESMTPSA id c10sm31539295wrt.65.2019.03.27.23.36.01 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Wed, 27 Mar 2019 23:36:01 -0700 (PDT) Date: Thu, 28 Mar 2019 07:36:00 +0100 From: Andrea Righi To: Pravin B Shelar Cc: "David S. Miller" , netdev@vger.kernel.org, dev@openvswitch.org, linux-kernel@vger.kernel.org Subject: [PATCH v2] openvswitch: fix flow actions reallocation Message-ID: <20190328063600.GC16096@xps-13> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.10.1 (2018-07-13) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org The flow action buffer can be resized if it's not big enough to contain all the requested flow actions. However, this resize doesn't take into account the new requested size, the buffer is only increased by a factor of 2x. This might be not enough to contain the new data, causing a buffer overflow, for example: [ 42.044472] ============================================================================= [ 42.045608] BUG kmalloc-96 (Not tainted): Redzone overwritten [ 42.046415] ----------------------------------------------------------------------------- [ 42.047715] Disabling lock debugging due to kernel taint [ 42.047716] INFO: 0x8bf2c4a5-0x720c0928. First byte 0x0 instead of 0xcc [ 42.048677] INFO: Slab 0xbc6d2040 objects=29 used=18 fp=0xdc07dec4 flags=0x2808101 [ 42.049743] INFO: Object 0xd53a3464 @offset=2528 fp=0xccdcdebb [ 42.050747] Redzone 76f1b237: cc cc cc cc cc cc cc cc ........ [ 42.051839] Object d53a3464: 6b 6b 6b 6b 6b 6b 6b 6b 0c 00 00 00 6c 00 00 00 kkkkkkkk....l... [ 42.053015] Object f49a30cc: 6c 00 0c 00 00 00 00 00 00 00 00 03 78 a3 15 f6 l...........x... [ 42.054203] Object acfe4220: 20 00 02 00 ff ff ff ff 00 00 00 00 00 00 00 00 ............... [ 42.055370] Object 21024e91: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 42.056541] Object 070e04c3: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 42.057797] Object 948a777a: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 42.059061] Redzone 8bf2c4a5: 00 00 00 00 .... [ 42.060189] Padding a681b46e: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ Fix by making sure the new buffer is properly resized to contain all the requested data. BugLink: https://bugs.launchpad.net/bugs/1813244 Signed-off-by: Andrea Righi Acked-by: Pravin B Shelar --- Changes in v2: - correctly resize to current_size+req_size (thanks to Pravin) net/openvswitch/flow_netlink.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c index 691da853bef5..4bdf5e3ac208 100644 --- a/net/openvswitch/flow_netlink.c +++ b/net/openvswitch/flow_netlink.c @@ -2306,14 +2306,14 @@ static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa, struct sw_flow_actions *acts; int new_acts_size; - int req_size = NLA_ALIGN(attr_len); + size_t req_size = NLA_ALIGN(attr_len); int next_offset = offsetof(struct sw_flow_actions, actions) + (*sfa)->actions_len; if (req_size <= (ksize(*sfa) - next_offset)) goto out; - new_acts_size = ksize(*sfa) * 2; + new_acts_size = max(next_offset + req_size, ksize(*sfa) * 2); if (new_acts_size > MAX_ACTIONS_BUFSIZE) { if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size) {