[v5] net/eth: Fix stack-buffer-overflow in _eth_get_rss_ex_dst_addr()

[PATCH v5 4/7] net/eth: Check the size earlier

Posted by Philippe Mathieu-Daudé 4 years, 8 months ago

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
---
 net/eth.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/net/eth.c b/net/eth.c
index 7c47a267a7a..e870d02b0df 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -406,16 +406,14 @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
                         struct in6_address *dst_addr)
 {
     struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;
+    size_t input_size = iov_size(pkt, pkt_frags);
+    size_t bytes_read;
+
+    if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) {
+        return false;
+    }
 
     if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
-
-        size_t input_size = iov_size(pkt, pkt_frags);
-        size_t bytes_read;
-
-        if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) {
-            return false;
-        }
-
         bytes_read = iov_to_buf(pkt, pkt_frags,
                                 ext_hdr_offset + sizeof(*ext_hdr),
                                 dst_addr, sizeof(*dst_addr));
-- 
2.26.2

Re: [PATCH v5 4/7] net/eth: Check the size earlier

Posted by Stefano Garzarella 4 years, 8 months ago

On Wed, Mar 10, 2021 at 05:01:32PM +0100, Philippe Mathieu-Daudé wrote:
>Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
>---
> net/eth.c | 14 ++++++--------
> 1 file changed, 6 insertions(+), 8 deletions(-)

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>

>
>diff --git a/net/eth.c b/net/eth.c
>index 7c47a267a7a..e870d02b0df 100644
>--- a/net/eth.c
>+++ b/net/eth.c
>@@ -406,16 +406,14 @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
>                         struct in6_address *dst_addr)
> {
>     struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;
>+    size_t input_size = iov_size(pkt, pkt_frags);
>+    size_t bytes_read;
>+
>+    if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) {
>+        return false;
>+    }
>
>     if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
>-
>-        size_t input_size = iov_size(pkt, pkt_frags);
>-        size_t bytes_read;
>-
>-        if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) {
>-            return false;
>-        }
>-
>         bytes_read = iov_to_buf(pkt, pkt_frags,
>                                 ext_hdr_offset + sizeof(*ext_hdr),
>                                 dst_addr, sizeof(*dst_addr));
>-- 
>2.26.2
>