leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

openvswitch: Prevent kernel-infoleak in ovs_ct_put_key()

Browse Source 
ovs_ct_put_key() is potentially copying uninitialized kernel stack memory
into socket buffers, since the compiler may leave a 3-byte hole at the end
of `struct ovs_key_ct_tuple_ipv4` and `struct ovs_key_ct_tuple_ipv6`. Fix
it by initializing `orig` with memset().

Fixes: 9dd7f8907c ("openvswitch: Add original direction conntrack tuple to sw_flow_key.")
Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Peilin Ye 2020-07-31 00:48:38 -04:00 committed by David S. Miller
parent 038ebb1a71
commit 9aba6c5b49
1 changed files with 20 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
net/openvswitch/conntrack.c
View File

@ -276,10 +276,6 @@ void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key)
ovs_ct_update_key(skb, NULL, key, false, false);
}
#define IN6_ADDR_INITIALIZER(ADDR) \
{ (ADDR).s6_addr32[0], (ADDR).s6_addr32[1], \
(ADDR).s6_addr32[2], (ADDR).s6_addr32[3] }
int ovs_ct_put_key(const struct sw_flow_key *swkey,
const struct sw_flow_key *output, struct sk_buff *skb)
{
@ -301,24 +297,30 @@ int ovs_ct_put_key(const struct sw_flow_key *swkey,
if (swkey->ct_orig_proto) {
if (swkey->eth.type == htons(ETH_P_IP)) {
struct ovs_key_ct_tuple_ipv4 orig = {
output->ipv4.ct_orig.src,
output->ipv4.ct_orig.dst,
output->ct.orig_tp.src,
output->ct.orig_tp.dst,
output->ct_orig_proto,
};
struct ovs_key_ct_tuple_ipv4 orig;
memset(&orig, 0, sizeof(orig));
orig.ipv4_src = output->ipv4.ct_orig.src;
orig.ipv4_dst = output->ipv4.ct_orig.dst;
orig.src_port = output->ct.orig_tp.src;
orig.dst_port = output->ct.orig_tp.dst;
orig.ipv4_proto = output->ct_orig_proto;
if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4,
sizeof(orig), &orig))
return -EMSGSIZE;
} else if (swkey->eth.type == htons(ETH_P_IPV6)) {
struct ovs_key_ct_tuple_ipv6 orig = {
IN6_ADDR_INITIALIZER(output->ipv6.ct_orig.src),
IN6_ADDR_INITIALIZER(output->ipv6.ct_orig.dst),
output->ct.orig_tp.src,
output->ct.orig_tp.dst,
output->ct_orig_proto,
};
struct ovs_key_ct_tuple_ipv6 orig;
memset(&orig, 0, sizeof(orig));
memcpy(orig.ipv6_src, output->ipv6.ct_orig.src.s6_addr32,
sizeof(orig.ipv6_src));
memcpy(orig.ipv6_dst, output->ipv6.ct_orig.dst.s6_addr32,
sizeof(orig.ipv6_dst));
orig.src_port = output->ct.orig_tp.src;
orig.dst_port = output->ct.orig_tp.dst;
orig.ipv6_proto = output->ct_orig_proto;
if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6,
sizeof(orig), &orig))
return -EMSGSIZE;