From: Ferruh Yigit <ferruh.yigit@intel.com>
To: Radu Nicolau <radu.nicolau@intel.com>, dev@dpdk.org
Cc: declan.doherty@intel.com, chas3@att.com, stable@dpdk.org
Subject: Re: [dpdk-dev] [PATCH v2] net/bonding: fix potential out of bounds read
Date: Wed, 17 Apr 2019 15:25:22 +0100 [thread overview]
Message-ID: <a5b11303-a7c5-a16d-af4f-e2c7d291bf0e@intel.com> (raw)
Message-ID: <20190417142522.SGUs--ecQ3XinjKG2UcpGRRXip69rkUAi_zTZ42ON3s@z> (raw)
In-Reply-To: <1555493621-353-1-git-send-email-radu.nicolau@intel.com>
On 4/17/2019 10:33 AM, Radu Nicolau wrote:
> Add validation to pointer constructed from the IPv4 header length
> in order to prevent malformed packets from generating a potential
> out of bounds memory read.
>
> Fixes: 09150784a776 ("net/bonding: burst mode hash calculation")
> Cc: stable@dpdk.org
>
> Signed-off-by: Radu Nicolau <radu.nicolau@intel.com>
> ---
> v2: add fixes lines
>
> drivers/net/bonding/rte_eth_bond_pmd.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/bonding/rte_eth_bond_pmd.c b/drivers/net/bonding/rte_eth_bond_pmd.c
> index b0d191d..25dbddc 100644
> --- a/drivers/net/bonding/rte_eth_bond_pmd.c
> +++ b/drivers/net/bonding/rte_eth_bond_pmd.c
> @@ -842,6 +842,7 @@ burst_xmit_l34_hash(struct rte_mbuf **buf, uint16_t nb_pkts,
>
> for (i = 0; i < nb_pkts; i++) {
> eth_hdr = rte_pktmbuf_mtod(buf[i], struct ether_hdr *);
> + size_t pkt_end = (size_t)eth_hdr + rte_pktmbuf_pkt_len(buf[i]);
I guess this should be 'data_len' instead.
> proto = eth_hdr->ether_type;
> vlan_offset = get_vlan_offset(eth_hdr, &proto);
> l3hash = 0;
> @@ -865,13 +866,17 @@ burst_xmit_l34_hash(struct rte_mbuf **buf, uint16_t nb_pkts,
> tcp_hdr = (struct tcp_hdr *)
> ((char *)ipv4_hdr +
> ip_hdr_offset);
> - l4hash = HASH_L4_PORTS(tcp_hdr);
> + if ((size_t)tcp_hdr + sizeof(*tcp_hdr)
> + < pkt_end)
> + l4hash = HASH_L4_PORTS(tcp_hdr);
> } else if (ipv4_hdr->next_proto_id ==
> IPPROTO_UDP) {
> udp_hdr = (struct udp_hdr *)
> ((char *)ipv4_hdr +
> ip_hdr_offset);
> - l4hash = HASH_L4_PORTS(udp_hdr);
> + if ((size_t)udp_hdr + sizeof(*udp_hdr)
> + < pkt_end)
> + l4hash = HASH_L4_PORTS(udp_hdr);
> }
> }
> } else if (rte_cpu_to_be_16(ETHER_TYPE_IPv6) == proto) {
>
Other thing is on action to take when malformed packet is detected, right now it
just prevents the out of bound memory access, but calculated hash will be wrong.
What do you think skipping/dropping the packet in that case, if possible?
next prev parent reply other threads:[~2019-04-17 14:25 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-15 9:27 [dpdk-dev] [PATCH] " Radu Nicolau
2019-04-15 9:27 ` Radu Nicolau
2019-04-16 16:07 ` Ferruh Yigit
2019-04-16 16:07 ` Ferruh Yigit
2019-04-17 9:33 ` [dpdk-dev] [PATCH v2] " Radu Nicolau
2019-04-17 9:33 ` Radu Nicolau
2019-04-17 14:25 ` Ferruh Yigit [this message]
2019-04-17 14:25 ` Ferruh Yigit
2019-04-17 14:36 ` [dpdk-dev] [PATCH v3] " Radu Nicolau
2019-04-17 14:36 ` Radu Nicolau
2019-04-18 18:41 ` Ferruh Yigit
2019-04-18 18:41 ` Ferruh Yigit
2019-04-18 22:57 ` Chas Williams
2019-04-18 22:57 ` Chas Williams
2019-04-19 9:43 ` Ferruh Yigit
2019-04-19 9:43 ` Ferruh Yigit
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=a5b11303-a7c5-a16d-af4f-e2c7d291bf0e@intel.com \
--to=ferruh.yigit@intel.com \
--cc=chas3@att.com \
--cc=declan.doherty@intel.com \
--cc=dev@dpdk.org \
--cc=radu.nicolau@intel.com \
--cc=stable@dpdk.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).