From: Daniel Borkmann <daniel@iogearbox•net>
To: Jamal Hadi Salim <jhs@mojatatu•com>, davem@davemloft•net
Cc: netdev@vger•kernel.org, xiyou.wangcong@gmail•com,
alexei.starovoitov@gmail•com, john.fastabend@gmail•com,
dj@verizon•com
Subject: Re: [net-next PATCH v2 1/5] introduce IFE action
Date: Wed, 24 Feb 2016 18:37:49 +0100 [thread overview]
Message-ID: <56CDEA6D.1000908@iogearbox.net> (raw)
In-Reply-To: <1456231760-2513-2-git-send-email-jhs@emojatatu.com>
On 02/23/2016 01:49 PM, Jamal Hadi Salim wrote:
> From: Jamal Hadi Salim <jhs@mojatatu•com>
[...]
> +static const struct nla_policy ife_policy[TCA_IFE_MAX + 1] = {
> + [TCA_IFE_PARMS] = {.len = sizeof(struct tc_ife)},
> + [TCA_IFE_DMAC] = {.type = NLA_BINARY,.len = ETH_ALEN},
> + [TCA_IFE_SMAC] = {.type = NLA_BINARY,.len = ETH_ALEN},
This is buggy btw ...
> + [TCA_IFE_TYPE] = {.type = NLA_U16},
> +};
[...]
> + if (parm->flags & IFE_ENCODE) {
> + ife_type = *(u16 *) nla_data(tb[TCA_IFE_TYPE]);
( We have accessors for such things. Please also check coding style
and white space things in your series, there's couple of things all
over the place. )
> + if (tb[TCA_IFE_DMAC] != NULL)
> + daddr = nla_data(tb[TCA_IFE_DMAC]);
> + if (tb[TCA_IFE_SMAC] != NULL)
> + saddr = nla_data(tb[TCA_IFE_SMAC]);
... NLA_BINARY with len means: max length. But there's nothing
that checks a min length on this, so you potentially access out
of bounds since everything <= ETH_ALEN is allowed in your case.
> + }
> +
> + spin_lock_bh(&ife->tcf_lock);
Maybe try to make this lockless in the fast path? Otherwise placing
this on ingress / egress (f.e. clsact) doesn't really scale.
> + ife->tcf_action = parm->action;
> +
> + if (parm->flags & IFE_ENCODE) {
> + if (daddr)
> + ether_addr_copy(ife->eth_dst, daddr);
> + else
> + eth_zero_addr(ife->eth_dst);
> +
> + if (saddr)
> + ether_addr_copy(ife->eth_src, saddr);
> + else
> + eth_zero_addr(ife->eth_src);
> +
> + ife->eth_type = ife_type;
> + }
next prev parent reply other threads:[~2016-02-24 17:37 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-23 12:49 [net-next PATCH v2 0/5] net_sched: Add support for IFE action Jamal Hadi Salim
2016-02-23 12:49 ` [net-next PATCH v2 1/5] introduce " Jamal Hadi Salim
2016-02-23 13:32 ` Daniel Borkmann
2016-02-23 14:39 ` Jamal Hadi Salim
2016-02-23 16:12 ` Daniel Borkmann
2016-02-23 21:31 ` Cong Wang
2016-02-24 5:46 ` Simon Horman
2016-02-24 12:39 ` Jamal Hadi Salim
2016-02-24 12:52 ` Jamal Hadi Salim
2016-02-23 21:44 ` Cong Wang
2016-02-24 13:09 ` Jamal Hadi Salim
2016-02-24 17:39 ` Cong Wang
2016-02-24 17:37 ` Daniel Borkmann [this message]
2016-02-25 12:20 ` Jamal Hadi Salim
2016-02-25 21:46 ` Daniel Borkmann
2016-02-25 22:07 ` John Fastabend
2016-02-25 22:46 ` Jamal Hadi Salim
2016-02-23 12:49 ` [net-next PATCH v2 2/5] Support to encoding decoding skb mark on " Jamal Hadi Salim
2016-02-23 12:49 ` [net-next PATCH v2 3/5] Support to encoding decoding skb prio " Jamal Hadi Salim
2016-02-23 12:49 ` [net-next PATCH v2 4/5] Support to encoding decoding skb hashid " Jamal Hadi Salim
2016-02-23 12:49 ` [net-next PATCH v2 5/5] Support to encoding decoding skb queue map " Jamal Hadi Salim
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56CDEA6D.1000908@iogearbox.net \
--to=daniel@iogearbox$(echo .)net \
--cc=alexei.starovoitov@gmail$(echo .)com \
--cc=davem@davemloft$(echo .)net \
--cc=dj@verizon$(echo .)com \
--cc=jhs@mojatatu$(echo .)com \
--cc=john.fastabend@gmail$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=xiyou.wangcong@gmail$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox