mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-08-09 06:14:34 +02:00
Jamal Hadi SalimandPaolo Abeni
8b519cbcab
There is a TOCTOU race condition in flower lockless approach between sizing
a flow_rule buffer and filling it.
zdi-disclosures@trendmicro.com reports:
The cls_flower classifier operates with TCF_PROTO_OPS_DOIT_UNLOCKED
(fl_change runs without RTNL), while RTM_NEWACTION holds RTNL, so the
independent locking domains make the race reachable in practice. KASAN
confirms:
BUG: KASAN: slab-out-of-bounds in tcf_pedit_offload_act_setup+0x81b/0x930
Write of size 4 at addr ffff888001f27520 by task poc-toctou/312
The buggy address is located 0 bytes to the right of
allocated 288-byte region [ffff888001f27400, ffff888001f27520)
(cache kmalloc-512)
Note: The result is a heap OOB write attacker-controlled content into the
adjacent slab object (requires CAP_NET_ADMIN).
The fix introduces reading tcfp_nkeys under act->tcfa_lock in all places
using a new tcf_pedit_nkeys_locked() which replaces the old tcf_pedit_nkeys().
Additionally we close the remaining TOCTOU window between the sizing read and
the fill reads by more careful accounting.
Rather than silently truncating the key count, which leads to incorrect
action semantics offloaded to hardware and secondary OOB writes if
the remaining capacity is zero or consumed by prior actions, we enforce
remaining capacity checks and return -ENOSPC if the required space exceeds
the remaining capacity.
Fixes: 71d0ed7079 ("net/act_pedit: Support using offset relative to the conventional network headers")
Reported-by: zdi-disclosures@trendmicro.com
Tested-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260701161912.125355-1-jhs@mojatatu.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
118 lines
2.5 KiB
C
118 lines
2.5 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef __NET_TC_PED_H
|
|
#define __NET_TC_PED_H
|
|
|
|
#include <net/act_api.h>
|
|
#include <linux/tc_act/tc_pedit.h>
|
|
#include <linux/types.h>
|
|
|
|
struct tcf_pedit_key_ex {
|
|
enum pedit_header_type htype;
|
|
enum pedit_cmd cmd;
|
|
};
|
|
|
|
struct tcf_pedit_parms {
|
|
struct tc_pedit_key *tcfp_keys;
|
|
struct tcf_pedit_key_ex *tcfp_keys_ex;
|
|
int action;
|
|
unsigned char tcfp_nkeys;
|
|
unsigned char tcfp_flags;
|
|
struct rcu_head rcu;
|
|
};
|
|
|
|
struct tcf_pedit {
|
|
struct tc_action common;
|
|
struct tcf_pedit_parms __rcu *parms;
|
|
};
|
|
|
|
#define to_pedit(a) ((struct tcf_pedit *)a)
|
|
#define to_pedit_parms(a) (rcu_dereference(to_pedit(a)->parms))
|
|
|
|
static inline bool is_tcf_pedit(const struct tc_action *a)
|
|
{
|
|
#ifdef CONFIG_NET_CLS_ACT
|
|
if (a->ops && a->ops->id == TCA_ID_PEDIT)
|
|
return true;
|
|
#endif
|
|
return false;
|
|
}
|
|
|
|
/* Must be called with act->tcfa_lock held to ensure consistency of parallel
|
|
* reads of the same action's pedit keys (e.g. flow_offload count vs fill).
|
|
* Note, this is only used for pedit offload.
|
|
*/
|
|
static inline int tcf_pedit_nkeys_locked(const struct tc_action *a)
|
|
{
|
|
lockdep_assert_held(&a->tcfa_lock);
|
|
return rcu_dereference_protected(to_pedit(a)->parms,
|
|
lockdep_is_held(&a->tcfa_lock))->tcfp_nkeys;
|
|
}
|
|
|
|
static inline u32 tcf_pedit_htype(const struct tc_action *a, int index)
|
|
{
|
|
u32 htype = TCA_PEDIT_KEY_EX_HDR_TYPE_NETWORK;
|
|
struct tcf_pedit_parms *parms;
|
|
|
|
rcu_read_lock();
|
|
parms = to_pedit_parms(a);
|
|
if (parms->tcfp_keys_ex)
|
|
htype = parms->tcfp_keys_ex[index].htype;
|
|
rcu_read_unlock();
|
|
|
|
return htype;
|
|
}
|
|
|
|
static inline u32 tcf_pedit_cmd(const struct tc_action *a, int index)
|
|
{
|
|
struct tcf_pedit_parms *parms;
|
|
u32 cmd = __PEDIT_CMD_MAX;
|
|
|
|
rcu_read_lock();
|
|
parms = to_pedit_parms(a);
|
|
if (parms->tcfp_keys_ex)
|
|
cmd = parms->tcfp_keys_ex[index].cmd;
|
|
rcu_read_unlock();
|
|
|
|
return cmd;
|
|
}
|
|
|
|
static inline u32 tcf_pedit_mask(const struct tc_action *a, int index)
|
|
{
|
|
struct tcf_pedit_parms *parms;
|
|
u32 mask;
|
|
|
|
rcu_read_lock();
|
|
parms = to_pedit_parms(a);
|
|
mask = parms->tcfp_keys[index].mask;
|
|
rcu_read_unlock();
|
|
|
|
return mask;
|
|
}
|
|
|
|
static inline u32 tcf_pedit_val(const struct tc_action *a, int index)
|
|
{
|
|
struct tcf_pedit_parms *parms;
|
|
u32 val;
|
|
|
|
rcu_read_lock();
|
|
parms = to_pedit_parms(a);
|
|
val = parms->tcfp_keys[index].val;
|
|
rcu_read_unlock();
|
|
|
|
return val;
|
|
}
|
|
|
|
static inline u32 tcf_pedit_offset(const struct tc_action *a, int index)
|
|
{
|
|
struct tcf_pedit_parms *parms;
|
|
u32 off;
|
|
|
|
rcu_read_lock();
|
|
parms = to_pedit_parms(a);
|
|
off = parms->tcfp_keys[index].off;
|
|
rcu_read_unlock();
|
|
|
|
return off;
|
|
}
|
|
#endif /* __NET_TC_PED_H */
|