Re: [ovs-dev] [PATCH net] net: ovs: prevent underflow in queue_userspace_packet()
From: Aaron Conole <aconole@redhat.com>
Date: 2025-01-25 00:42:37
Also in:
kernel-janitors, lkml
Dan Carpenter [off-list ref] writes:
If "hlen" less than "cutlen" then when we call upcall_msg_size()
the "hlen - cutlen" parameter will be a very high positive
number.
Later in the function we use "skb->len - cutlen" but this change
addresses that potential underflow since skb->len is always going to
be greater than or equal to hlen.
Fixes: f2a4d086ed4c ("openvswitch: Add packet truncation support.")
Signed-off-by: Dan Carpenter <redacted>
---
From code review not testing.I think it's pretty difficult to trigger this case. 'cutlen' will only be set by a TRUNC action attribute, which does a length check there.
quoted hunk
net/openvswitch/datapath.c | 5 +++++ 1 file changed, 5 insertions(+)diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c index 225f6048867f..bb25a2bbe8a0 100644 --- a/net/openvswitch/datapath.c +++ b/net/openvswitch/datapath.c@@ -477,6 +477,11 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb, else hlen = skb->len; + if (hlen < cutlen) { + err = -EINVAL; + goto out; + } +
I think the right change would be more like: if (hlen < cutlen) cutlen = 0; Since trunc is supposed to be a cap on the length to trim the packet. If the cut length would be longer than the packet, then the whole packet should fit.
len = upcall_msg_size(upcall_info, hlen - cutlen, OVS_CB(skb)->acts_origlen); user_skb = genlmsg_new(len, GFP_ATOMIC);