diff options
| author | Dongli Zhang <dongli.zhang@oracle.com> | 2024-07-24 10:04:52 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-07-27 11:40:36 +0200 |
| commit | 8418f55302fa1d2eeb73e16e345167e545c598a5 (patch) | |
| tree | 609856f561d95e692ec1961b87405a7f4616d118 | |
| parent | ed898f9ca3fa32c56c858b463ceb9d9936cc69c4 (diff) | |
| download | linux-stable-8418f55302fa1d2eeb73e16e345167e545c598a5.tar.gz linux-stable-8418f55302fa1d2eeb73e16e345167e545c598a5.tar.bz2 linux-stable-8418f55302fa1d2eeb73e16e345167e545c598a5.zip | |
tun: add missing verification for short frame
commit 049584807f1d797fc3078b68035450a9769eb5c3 upstream.
The cited commit missed to check against the validity of the frame length
in the tun_xdp_one() path, which could cause a corrupted skb to be sent
downstack. Even before the skb is transmitted, the
tun_xdp_one-->eth_type_trans() may access the Ethernet header although it
can be less than ETH_HLEN. Once transmitted, this could either cause
out-of-bound access beyond the actual length, or confuse the underlayer
with incorrect or inconsistent header length in the skb metadata.
In the alternative path, tun_get_user() already prohibits short frame which
has the length less than Ethernet header size from being transmitted for
IFF_TAP.
This is to drop any frame shorter than the Ethernet header size just like
how tun_get_user() does.
CVE: CVE-2024-41091
Inspired-by: https://lore.kernel.org/netdev/1717026141-25716-1-git-send-email-si-wei.liu@oracle.com/
Fixes: 043d222f93ab ("tuntap: accept an array of XDP buffs through sendmsg()")
Cc: stable@vger.kernel.org
Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
Reviewed-by: Si-Wei Liu <si-wei.liu@oracle.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
Link: https://patch.msgid.link/20240724170452.16837-3-dongli.zhang@oracle.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/net/tun.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 9254bca2813d..4a5107117b4a 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -2451,6 +2451,9 @@ static int tun_xdp_one(struct tun_struct *tun, bool skb_xdp = false; struct page *page; + if (unlikely(datasize < ETH_HLEN)) + return -EINVAL; + xdp_prog = rcu_dereference(tun->xdp_prog); if (xdp_prog) { if (gso->gso_type) { |