d/numam-dpdk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

net/bonding: fix potential out of bounds read

Browse Source 
Add validation to pointer constructed from the IPv4 header length
in order to prevent malformed packets from generating a potential
out of bounds memory read.

Fixes: 09150784a776 ("net/bonding: burst mode hash calculation")
Cc: stable@dpdk.org

Signed-off-by: Radu Nicolau <radu.nicolau@intel.com>
Acked-by: Chas Williams <chas3@att.com>
This commit is contained in:
Radu Nicolau 2019-04-17 15:36:47 +01:00 committed by Ferruh Yigit
parent 16c86b9843
commit 726158060d
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/net/bonding/rte_eth_bond_pmd.c
View File

@ -841,6 +841,7 @@ burst_xmit_l34_hash(struct rte_mbuf **buf, uint16_t nb_pkts,
for (i = 0; i < nb_pkts; i++) { for (i = 0; i < nb_pkts; i++) {
eth_hdr = rte_pktmbuf_mtod(buf[i], struct ether_hdr *); eth_hdr = rte_pktmbuf_mtod(buf[i], struct ether_hdr *);
size_t pkt_end = (size_t)eth_hdr + rte_pktmbuf_data_len(buf[i]);
proto = eth_hdr->ether_type; proto = eth_hdr->ether_type;
vlan_offset = get_vlan_offset(eth_hdr, &proto); vlan_offset = get_vlan_offset(eth_hdr, &proto);
l3hash = 0; l3hash = 0;
@ -864,12 +865,16 @@ burst_xmit_l34_hash(struct rte_mbuf **buf, uint16_t nb_pkts,
tcp_hdr = (struct tcp_hdr *) tcp_hdr = (struct tcp_hdr *)
((char *)ipv4_hdr + ((char *)ipv4_hdr +
ip_hdr_offset); ip_hdr_offset);
if ((size_t)tcp_hdr + sizeof(*tcp_hdr)
< pkt_end)
l4hash = HASH_L4_PORTS(tcp_hdr); l4hash = HASH_L4_PORTS(tcp_hdr);
} else if (ipv4_hdr->next_proto_id == } else if (ipv4_hdr->next_proto_id ==
IPPROTO_UDP) { IPPROTO_UDP) {
udp_hdr = (struct udp_hdr *) udp_hdr = (struct udp_hdr *)
((char *)ipv4_hdr + ((char *)ipv4_hdr +
ip_hdr_offset); ip_hdr_offset);
if ((size_t)udp_hdr + sizeof(*udp_hdr)
< pkt_end)
l4hash = HASH_L4_PORTS(udp_hdr); l4hash = HASH_L4_PORTS(udp_hdr);
} }
} }