From nobody Tue Sep 29 04:12:16 2026 Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 793A53FF1B5 for ; Wed, 12 Aug 2026 21:53:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786571633; cv=none; b=cPaBu7D+MY9r8DR8fTLMI3r2OZOWsNuaxGOy7OGGnnpbhrpDpQr9JmZpE8HHdag86LYG/T2nM5ew0AKPZbJmEczHXbP6UknZEF4RLzubKHJ4rvaNBkCTIKsku3snnZimQGigqzSmLSMilsITQvmnlrLzYYSMUdJAP4fT7yf26Sg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786571633; c=relaxed/simple; bh=NbuI1J9IP7noyKzuVPrlIzVZcUbUYEUIqvws0vDEKTQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=M618CjDk2lDOnZTfMyulfV44hHdtYzUDsi5o2PhJ9ie7IUflrP682KbCxKC4mLGUMVVdVaBKSq/O8GK17RNotCYcpDpUCZK+nuzRVflHGkhjU7PuI/DxnpTNHVt6D3ELTLV2+PW1ugohTEOvAbx5sGiVIX/oxcUpSFBiTKgupi8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu; spf=pass smtp.mailfrom=asu.edu; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b=eQUPJjyp; arc=none smtp.client-ip=209.85.216.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=asu.edu Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b="eQUPJjyp" Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-38f0f132f56so351027a91.0 for ; Wed, 12 Aug 2026 14:53:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=asu.edu; s=google; t=1786571632; x=1787176432; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=8LoBPhnL22x/EjK2WdlXIQmpvcgjinHL/ADzBX0WZkE=; b=eQUPJjypiY47AzIUOJmOdrxkhwTX8nDIA4GMEW3BNszVDbmwLKbwKMFAkPr4tmgfcw 10Qi0T2MS1dMU2bbEHX1ar1kWYAW0U/37zI8gOXGK+HkjXB2l/jKKbp+WDwajFUnaL84 3oHfPLUDZATlUk7mK9monU7JAYoCdSrDBqrXnX+A8n8Keij07bGerm72eGP3b8GJemqg PfJz4B2/94wjdaTW5AxuBeYOx1q7PBPEB9u6aILXPhQuSBIx8R6PMtO/S/pexZwPWGAN HXGvwhRJ9dhLK1LN4cQbe+FxWrEUwG8mPqwRmiUrw6Qr13BXhoCWrHbgzhHCgY3JBk/Z 9JMA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786571632; x=1787176432; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=8LoBPhnL22x/EjK2WdlXIQmpvcgjinHL/ADzBX0WZkE=; b=Vf8V2byGdJ6bBYYQ16ckoptDCuJ5MXSi7zzBl7+pIviuNvufr+bCzAkqAb95yj657g n44QLLsc8SDRO/M/5FPtef6J3BcM6rGlkymDhWFU17VEvqXDScE2M6Fbf8rmrczxDZMa tbnOzhqWq7KbV70ayDXORVIVaJl96obYhNmLTfCRnXAYWAPGLf/quYHUVRlh1qi2ePO2 I7nHtHqnsLQPGGFhd7lpe4uc46Tmq5kP45flegSmvMEJV2IbVK9eCCxuVBZPMGvGONL7 MYePPO4QRmmK87y+Fx983urs0wUyhDzMs2u962Dw6VK7TaoJ+7PsUov7JV8UznuocWfT M3HA== X-Forwarded-Encrypted: i=1; AHgh+Rp+9xreVRfIKcg5mA6N3tLPEfk4eH8O6T5c+nrhRAfXcqtQ1VCoFijK+mOiI8WPNTNV9Gri4cHb4Zqhv7M=@vger.kernel.org X-Gm-Message-State: AOJu0Yxv0xYr+Mi6r0pSntXw7yLq4ZYzL5KFuhNSlTt142XhbJXD8GA/ 9hy5Wng3qt2aWw2r6ggmq0TCtxadUuykzJVfu2u5xi7hiLmq1B+vb8bxQdezGF8Omw== X-Gm-Gg: AR+sD11pOOEqJaDTjHslKG8OeXIWdhn10ea/1r5KH1ptyzFUVDJTg1+eRTL+KyHlA4F 3ncnCmloVCIf9xvZR9NrGM2iKXdR9FdVc+upVtEW++0sb0NmRX3/LmEy6WgpmstTv3j1//NVBrp NhP95yN0ebLhOMipzNohcxOC1bh6BEVaQGyeSEI9jWmeLNC5069J+KW+39uR5a3kRFmX54BaSqT wcJeLMVpHVS0giuhD5vaRbRJAL79mFOrM9XXLKMb4mVg7MIQvjEPqdOakDOMFsMZSnAkWihklxn lR3l5Sjerh/5tBicfe9w7ltKdsgTbeLkchngsjdw9yVRso4gZeCEWJtZVATSeyVQgx7QgFH5hzO +70KiIAgA3rTfaG9m28Wwme698vKq5jRwOVFuGscif3fN/SuVbExokAX2ndrxncNIS+MVOQupg8 B/7Kr34ml6iPrO0QZsj4mxTrUYR5H4Y/xIE0cnJOHazkX5FCR1cOl6Mkwui0l1n24YcoRkig== X-Received: by 2002:a17:90b:264c:b0:369:7491:7b24 with SMTP id 98e67ed59e1d1-3931f47d73bmr492696a91.6.1786571631907; Wed, 12 Aug 2026 14:53:51 -0700 (PDT) Received: from p1.. (209-147-138-29.nat.asu.edu. [209.147.138.29]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-1412d964443sm1242178c88.9.2026.08.12.14.53.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 12 Aug 2026 14:53:51 -0700 (PDT) From: Xiang Mei To: Jakub Kicinski , Ido Schimmel , Andrew Lunn , "David S . Miller" , Eric Dumazet , Paolo Abeni , Roopa Prabhu Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Petr Machata , Andy Roulin , David Yang , Kees Cook , Weiming Shi , Xiang Mei Subject: [PATCH net RESEND] vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes Date: Wed, 12 Aug 2026 14:53:41 -0700 Message-ID: <20260812215341.763123-1-xmei5@asu.edu> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLA_BINARY with only a maximum length, so validate_nla() accepts a payload shorter than the address. The GROUP consumer reads it with nla_get_in_addr(), an unconditional 4-byte load, so a short attribute over-reads up to 3 bytes of uninitialised slab data, which are stored into remote_ip and echoed back via RTM_GETTUNNEL, disclosing kernel memory. Switch both entries to NLA_POLICY_EXACT_LEN() so the validator rejects any GROUP/GROUP6 that is not exactly 4 / 16 bytes; a valid address is always sent at full width. Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata devi= ce") Reported-by: Weiming Shi Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei Reviewed-by: Ido Schimmel --- resend: resend since netdev patch queue has overflown https://lore.kernel.org/all/20260704222254.914567-1-xmei5%40asu.edu/ drivers/net/vxlan/vxlan_vnifilter.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/net/vxlan/vxlan_vnifilter.c b/drivers/net/vxlan/vxlan_= vnifilter.c index 3e76f4e21094..dd94085e0886 100644 --- a/drivers/net/vxlan/vxlan_vnifilter.c +++ b/drivers/net/vxlan/vxlan_vnifilter.c @@ -462,10 +462,8 @@ static int vxlan_vnifilter_dump(struct sk_buff *skb, s= truct netlink_callback *cb static const struct nla_policy vni_filter_entry_policy[VXLAN_VNIFILTER_ENT= RY_MAX + 1] =3D { [VXLAN_VNIFILTER_ENTRY_START] =3D { .type =3D NLA_U32 }, [VXLAN_VNIFILTER_ENTRY_END] =3D { .type =3D NLA_U32 }, - [VXLAN_VNIFILTER_ENTRY_GROUP] =3D { .type =3D NLA_BINARY, - .len =3D sizeof_field(struct iphdr, daddr) }, - [VXLAN_VNIFILTER_ENTRY_GROUP6] =3D { .type =3D NLA_BINARY, - .len =3D sizeof(struct in6_addr) }, + [VXLAN_VNIFILTER_ENTRY_GROUP] =3D NLA_POLICY_EXACT_LEN(sizeof_field(struc= t iphdr, daddr)), + [VXLAN_VNIFILTER_ENTRY_GROUP6] =3D NLA_POLICY_EXACT_LEN(sizeof(struct in6= _addr)), }; =20 static const struct nla_policy vni_filter_policy[VXLAN_VNIFILTER_MAX + 1] = =3D { --=20 2.43.0