* [PATCH net 1/1] net_sched: cls_route: disallow handle of 0
@ 2022-08-14 11:27 Jamal Hadi Salim
2022-08-14 15:00 ` Stephen Hemminger
` (3 more replies)
0 siblings, 4 replies; 7+ messages in thread
From: Jamal Hadi Salim @ 2022-08-14 11:27 UTC (permalink / raw
To: davem, edumazet, kuba, pabeni
Cc: netdev, xiyou.wangcong, jiri, kuznet, cascardo, linux-distros,
security, stephen, dsahern, gregkh, Jamal Hadi Salim
Follows up on:
https://lore.kernel.org/all/20220809170518.164662-1-cascardo@canonical.com/
handle of 0 implies from/to of universe realm which is not very
sensible.
Lets see what this patch will do:
$sudo tc qdisc add dev $DEV root handle 1:0 prio
//lets manufacture a way to insert handle of 0
$sudo tc filter add dev $DEV parent 1:0 protocol ip prio 100 \
route to 0 from 0 classid 1:10 action ok
//gets rejected...
Error: handle of 0 is not valid.
We have an error talking to the kernel, -1
//lets create a legit entry..
sudo tc filter add dev $DEV parent 1:0 protocol ip prio 100 route from 10 \
classid 1:10 action ok
//what did the kernel insert?
$sudo tc filter ls dev $DEV parent 1:0
filter protocol ip pref 100 route chain 0
filter protocol ip pref 100 route chain 0 fh 0x000a8000 flowid 1:10 from 10
action order 1: gact action pass
random type none pass val 0
index 1 ref 1 bind 1
//Lets try to replace that legit entry with a handle of 0
$ sudo tc filter replace dev $DEV parent 1:0 protocol ip prio 100 \
handle 0x000a8000 route to 0 from 0 classid 1:10 action drop
Error: Replacing with handle of 0 is invalid.
We have an error talking to the kernel, -1
And last, lets run Cascardo's POC:
$ ./poc
0
0
-22
-22
-22
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
---
net/sched/cls_route.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index 3f935cbbaff6..48712bc51bda 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -424,6 +424,11 @@ static int route4_set_parms(struct net *net, struct tcf_proto *tp,
return -EINVAL;
}
+ if (!nhandle) {
+ NL_SET_ERR_MSG(extack, "Replacing with handle of 0 is invalid");
+ return -EINVAL;
+ }
+
h1 = to_hash(nhandle);
b = rtnl_dereference(head->table[h1]);
if (!b) {
@@ -477,6 +482,11 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
int err;
bool new = true;
+ if (!handle) {
+ NL_SET_ERR_MSG(extack, "Creating with handle of 0 is invalid");
+ return -EINVAL;
+ }
+
if (opt == NULL)
return handle ? -EINVAL : 0;
--
2.25.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH net 1/1] net_sched: cls_route: disallow handle of 0
2022-08-14 11:27 [PATCH net 1/1] net_sched: cls_route: disallow handle of 0 Jamal Hadi Salim
@ 2022-08-14 15:00 ` Stephen Hemminger
2022-08-15 11:00 ` patchwork-bot+netdevbpf
` (2 subsequent siblings)
3 siblings, 0 replies; 7+ messages in thread
From: Stephen Hemminger @ 2022-08-14 15:00 UTC (permalink / raw
To: Jamal Hadi Salim
Cc: davem, edumazet, kuba, pabeni, netdev, xiyou.wangcong, jiri,
kuznet, cascardo, linux-distros, security, dsahern, gregkh
On Sun, 14 Aug 2022 11:27:58 +0000
Jamal Hadi Salim <jhs@mojatatu.com> wrote:
> Follows up on:
> https://lore.kernel.org/all/20220809170518.164662-1-cascardo@canonical.com/
>
> handle of 0 implies from/to of universe realm which is not very
> sensible.
>
> Lets see what this patch will do:
> $sudo tc qdisc add dev $DEV root handle 1:0 prio
>
> //lets manufacture a way to insert handle of 0
> $sudo tc filter add dev $DEV parent 1:0 protocol ip prio 100 \
> route to 0 from 0 classid 1:10 action ok
>
> //gets rejected...
> Error: handle of 0 is not valid.
> We have an error talking to the kernel, -1
>
> //lets create a legit entry..
> sudo tc filter add dev $DEV parent 1:0 protocol ip prio 100 route from 10 \
> classid 1:10 action ok
>
> //what did the kernel insert?
> $sudo tc filter ls dev $DEV parent 1:0
> filter protocol ip pref 100 route chain 0
> filter protocol ip pref 100 route chain 0 fh 0x000a8000 flowid 1:10 from 10
> action order 1: gact action pass
> random type none pass val 0
> index 1 ref 1 bind 1
>
> //Lets try to replace that legit entry with a handle of 0
> $ sudo tc filter replace dev $DEV parent 1:0 protocol ip prio 100 \
> handle 0x000a8000 route to 0 from 0 classid 1:10 action drop
>
> Error: Replacing with handle of 0 is invalid.
> We have an error talking to the kernel, -1
>
> And last, lets run Cascardo's POC:
> $ ./poc
> 0
> 0
> -22
> -22
> -22
>
> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Acked-by: Stephen Hemminger <stephen@networkplumber.org>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH net 1/1] net_sched: cls_route: disallow handle of 0
2022-08-14 11:27 [PATCH net 1/1] net_sched: cls_route: disallow handle of 0 Jamal Hadi Salim
2022-08-14 15:00 ` Stephen Hemminger
@ 2022-08-15 11:00 ` patchwork-bot+netdevbpf
2022-08-15 17:44 ` Jakub Kicinski
2022-08-29 15:26 ` [vs-plain] " Anthony Liguori
3 siblings, 0 replies; 7+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-08-15 11:00 UTC (permalink / raw
To: Jamal Hadi Salim
Cc: davem, edumazet, kuba, pabeni, netdev, xiyou.wangcong, jiri,
kuznet, cascardo, linux-distros, security, stephen, dsahern,
gregkh
Hello:
This patch was applied to netdev/net.git (master)
by David S. Miller <davem@davemloft.net>:
On Sun, 14 Aug 2022 11:27:58 +0000 you wrote:
> Follows up on:
> https://lore.kernel.org/all/20220809170518.164662-1-cascardo@canonical.com/
>
> handle of 0 implies from/to of universe realm which is not very
> sensible.
>
> Lets see what this patch will do:
> $sudo tc qdisc add dev $DEV root handle 1:0 prio
>
> [...]
Here is the summary with links:
- [net,1/1] net_sched: cls_route: disallow handle of 0
https://git.kernel.org/netdev/net/c/02799571714d
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH net 1/1] net_sched: cls_route: disallow handle of 0
2022-08-14 11:27 [PATCH net 1/1] net_sched: cls_route: disallow handle of 0 Jamal Hadi Salim
2022-08-14 15:00 ` Stephen Hemminger
2022-08-15 11:00 ` patchwork-bot+netdevbpf
@ 2022-08-15 17:44 ` Jakub Kicinski
2022-08-16 10:25 ` Jamal Hadi Salim
2022-08-29 15:26 ` [vs-plain] " Anthony Liguori
3 siblings, 1 reply; 7+ messages in thread
From: Jakub Kicinski @ 2022-08-15 17:44 UTC (permalink / raw
To: Jamal Hadi Salim
Cc: davem, edumazet, pabeni, netdev, xiyou.wangcong, jiri, kuznet,
cascardo, linux-distros, security, stephen, dsahern, gregkh
On Sun, 14 Aug 2022 11:27:58 +0000 Jamal Hadi Salim wrote:
> Follows up on:
> https://lore.kernel.org/all/20220809170518.164662-1-cascardo@canonical.com/
>
> handle of 0 implies from/to of universe realm which is not very
> sensible.
Heh, I was gonna say, but then you acked the other fix :)
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH net 1/1] net_sched: cls_route: disallow handle of 0
2022-08-15 17:44 ` Jakub Kicinski
@ 2022-08-16 10:25 ` Jamal Hadi Salim
0 siblings, 0 replies; 7+ messages in thread
From: Jamal Hadi Salim @ 2022-08-16 10:25 UTC (permalink / raw
To: Jakub Kicinski
Cc: davem, edumazet, pabeni, netdev, xiyou.wangcong, jiri, kuznet,
cascardo, linux-distros, security, stephen, dsahern, gregkh
The earlier discussion was to let the other fix in to plug the CVE
hole (I had proposed
disallowing handle of 0 in that discussion).
cheers,
jamal
On Mon, Aug 15, 2022 at 1:44 PM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Sun, 14 Aug 2022 11:27:58 +0000 Jamal Hadi Salim wrote:
> > Follows up on:
> > https://lore.kernel.org/all/20220809170518.164662-1-cascardo@canonical.com/
> >
> > handle of 0 implies from/to of universe realm which is not very
> > sensible.
>
> Heh, I was gonna say, but then you acked the other fix :)
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [vs-plain] [PATCH net 1/1] net_sched: cls_route: disallow handle of 0
2022-08-14 11:27 [PATCH net 1/1] net_sched: cls_route: disallow handle of 0 Jamal Hadi Salim
` (2 preceding siblings ...)
2022-08-15 17:44 ` Jakub Kicinski
@ 2022-08-29 15:26 ` Anthony Liguori
2022-08-31 10:35 ` Jamal Hadi Salim
3 siblings, 1 reply; 7+ messages in thread
From: Anthony Liguori @ 2022-08-29 15:26 UTC (permalink / raw
To: Jamal Hadi Salim, davem, edumazet, kuba, pabeni
Cc: netdev, xiyou.wangcong, jiri, kuznet, cascardo, linux-distros,
security, stephen, dsahern, gregkh, Jamal Hadi Salim
Jamal Hadi Salim <jhs@mojatatu.com> writes:
> Follows up on:
> https://lore.kernel.org/all/20220809170518.164662-1-cascardo@canonical.com/
>
> handle of 0 implies from/to of universe realm which is not very
> sensible.
Hi,
This was posted two weeks ago and now that it's merged, could you please
post to oss-security?
I don't think there was an actual embargo on this one.
Regards,
Anthony Liguori
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [vs-plain] [PATCH net 1/1] net_sched: cls_route: disallow handle of 0
2022-08-29 15:26 ` [vs-plain] " Anthony Liguori
@ 2022-08-31 10:35 ` Jamal Hadi Salim
0 siblings, 0 replies; 7+ messages in thread
From: Jamal Hadi Salim @ 2022-08-31 10:35 UTC (permalink / raw
To: Anthony Liguori
Cc: davem, edumazet, kuba, pabeni, netdev, xiyou.wangcong, jiri,
kuznet, cascardo, linux-distros, security, stephen, dsahern,
gregkh
On Mon, Aug 29, 2022 at 11:26 AM Anthony Liguori <aliguori@amazon.com> wrote:
>
> Jamal Hadi Salim <jhs@mojatatu.com> writes:
>
> > Follows up on:
> > https://lore.kernel.org/all/20220809170518.164662-1-cascardo@canonical.com/
> >
> > handle of 0 implies from/to of universe realm which is not very
> > sensible.
>
> Hi,
>
> This was posted two weeks ago and now that it's merged, could you please
> post to oss-security?
>
> I don't think there was an actual embargo on this one.
>
Apologies, not familiar with the process and wasnt sure if this was
addressed to me.
Are you asking for this to be cross-posted to oss-security?
cheers,
jamal
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2022-08-31 10:36 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-08-14 11:27 [PATCH net 1/1] net_sched: cls_route: disallow handle of 0 Jamal Hadi Salim
2022-08-14 15:00 ` Stephen Hemminger
2022-08-15 11:00 ` patchwork-bot+netdevbpf
2022-08-15 17:44 ` Jakub Kicinski
2022-08-16 10:25 ` Jamal Hadi Salim
2022-08-29 15:26 ` [vs-plain] " Anthony Liguori
2022-08-31 10:35 ` Jamal Hadi Salim
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).