Subject: Re: [PATCH 0/2] Prevent potential write out of bounds

From: Jakub Kicinski <[email-masked]>
Date: Thu, 31 Aug 2023 18:28:00 -0700

On Thu, 31 Aug 2023 18:04:35 -0700 [email-masked] wrote:
> The function flow_rule_alloc in net/core/flow_offload.c [2] gets an
> unsigned int num_actions (line 10) and later traverses the actions in
> the rule (line 24) setting hw.stats to FLOW_ACTION_HW_STATS_DONT_CARE.
> 
> Within the same file, the loop in the line 24 compares a signed int
> (i) to an unsigned int (num_actions), and then uses i as an array
> index. If an integer overflow happens, then the array within the loop
> is wrongly indexed, causing a write out of bounds.
> 
> After checking with maintainers, it seems that the front-end caps the
> maximum value of num_action, thus it is not possible to reach the given
> write out of bounds, yet, still, to prevent disasters it is better to
> fix the signedness here.

How did you find this? The commit messages should include info
about how the issue was discovered.
-- 
pw-bot: cr