On Fri, Jan 24, 2025 at 07:42:26PM -0500, Aaron Conole wrote:

Dan Carpenter [off-list ref] writes:

quoted

If "hlen" less than "cutlen" then when we call upcall_msg_size()
the "hlen - cutlen" parameter will be a very high positive
number.

Later in the function we use "skb->len - cutlen" but this change
addresses that potential underflow since skb->len is always going to
be greater than or equal to hlen.

Fixes: f2a4d086ed4c ("openvswitch: Add packet truncation support.")
Signed-off-by: Dan Carpenter <redacted>
---
From code review not testing.

I think it's pretty difficult to trigger this case.  'cutlen' will only
be set by a TRUNC action attribute, which does a length check there.

Ah.  Yes.  You're right.  I assumed that since we neede to do a upper
bounds check on skb->len then probably the lower bounds needed to be
checked too but that's not correct.  My bad.  No need to do anything
here because the code is fine as-is.

net/openvswitch/actions.c
  1402                  case OVS_ACTION_ATTR_TRUNC: {
  1403                          struct ovs_action_trunc *trunc = nla_data(a);
  1404  
  1405                          if (skb->len > trunc->max_len)
  1406                                  OVS_CB(skb)->cutlen = skb->len - trunc->max_len;
  1407                          break;
  1408                  }

regards,
dan carpenter