Commit f87fda00 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller

bonding: prevent out of bound accesses

ether_addr_equal_64bits() requires some care about its arguments,
namely that 8 bytes might be read, even if last 2 byte values are not
used.

KASan detected a violation with null_mac_addr and lacpdu_mcast_addr
in bond_3ad.c

Same problem with mac_bcast[] and mac_v6_allmcast[] in bond_alb.c :
Although the 8-byte alignment was there, KASan would detect out
of bound accesses.

Fixes: 815117ad ("bonding: use ether_addr_equal_unaligned for bond addr compare")
Fixes: bb54e589 ("bonding: Verify RX LACPDU has proper dest mac-addr")
Fixes: 885a136c ("bonding: use compare_ether_addr_64bits() in ALB")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Acked-by: default avatarDmitry Vyukov <dvyukov@google.com>
Acked-by: default avatarNikolay Aleksandrov <nikolay@cumulusnetworks.com>
Acked-by: default avatarDing Tianhong <dingtianhong@huawei.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 3d8c4530
...@@ -101,11 +101,14 @@ enum ad_link_speed_type { ...@@ -101,11 +101,14 @@ enum ad_link_speed_type {
#define MAC_ADDRESS_EQUAL(A, B) \ #define MAC_ADDRESS_EQUAL(A, B) \
ether_addr_equal_64bits((const u8 *)A, (const u8 *)B) ether_addr_equal_64bits((const u8 *)A, (const u8 *)B)
static struct mac_addr null_mac_addr = { { 0, 0, 0, 0, 0, 0 } }; static const u8 null_mac_addr[ETH_ALEN + 2] __long_aligned = {
0, 0, 0, 0, 0, 0
};
static u16 ad_ticks_per_sec; static u16 ad_ticks_per_sec;
static const int ad_delta_in_ticks = (AD_TIMER_INTERVAL * HZ) / 1000; static const int ad_delta_in_ticks = (AD_TIMER_INTERVAL * HZ) / 1000;
static const u8 lacpdu_mcast_addr[ETH_ALEN] = MULTICAST_LACPDU_ADDR; static const u8 lacpdu_mcast_addr[ETH_ALEN + 2] __long_aligned =
MULTICAST_LACPDU_ADDR;
/* ================= main 802.3ad protocol functions ================== */ /* ================= main 802.3ad protocol functions ================== */
static int ad_lacpdu_send(struct port *port); static int ad_lacpdu_send(struct port *port);
...@@ -1739,7 +1742,7 @@ static void ad_clear_agg(struct aggregator *aggregator) ...@@ -1739,7 +1742,7 @@ static void ad_clear_agg(struct aggregator *aggregator)
aggregator->is_individual = false; aggregator->is_individual = false;
aggregator->actor_admin_aggregator_key = 0; aggregator->actor_admin_aggregator_key = 0;
aggregator->actor_oper_aggregator_key = 0; aggregator->actor_oper_aggregator_key = 0;
aggregator->partner_system = null_mac_addr; eth_zero_addr(aggregator->partner_system.mac_addr_value);
aggregator->partner_system_priority = 0; aggregator->partner_system_priority = 0;
aggregator->partner_oper_aggregator_key = 0; aggregator->partner_oper_aggregator_key = 0;
aggregator->receive_state = 0; aggregator->receive_state = 0;
...@@ -1761,7 +1764,7 @@ static void ad_initialize_agg(struct aggregator *aggregator) ...@@ -1761,7 +1764,7 @@ static void ad_initialize_agg(struct aggregator *aggregator)
if (aggregator) { if (aggregator) {
ad_clear_agg(aggregator); ad_clear_agg(aggregator);
aggregator->aggregator_mac_address = null_mac_addr; eth_zero_addr(aggregator->aggregator_mac_address.mac_addr_value);
aggregator->aggregator_identifier = 0; aggregator->aggregator_identifier = 0;
aggregator->slave = NULL; aggregator->slave = NULL;
} }
......
...@@ -42,13 +42,10 @@ ...@@ -42,13 +42,10 @@
#ifndef __long_aligned static const u8 mac_bcast[ETH_ALEN + 2] __long_aligned = {
#define __long_aligned __attribute__((aligned((sizeof(long)))))
#endif
static const u8 mac_bcast[ETH_ALEN] __long_aligned = {
0xff, 0xff, 0xff, 0xff, 0xff, 0xff 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
}; };
static const u8 mac_v6_allmcast[ETH_ALEN] __long_aligned = { static const u8 mac_v6_allmcast[ETH_ALEN + 2] __long_aligned = {
0x33, 0x33, 0x00, 0x00, 0x00, 0x01 0x33, 0x33, 0x00, 0x00, 0x00, 0x01
}; };
static const int alb_delta_in_ticks = HZ / ALB_TIMER_TICKS_PER_SEC; static const int alb_delta_in_ticks = HZ / ALB_TIMER_TICKS_PER_SEC;
......
...@@ -34,6 +34,9 @@ ...@@ -34,6 +34,9 @@
#define BOND_DEFAULT_MIIMON 100 #define BOND_DEFAULT_MIIMON 100
#ifndef __long_aligned
#define __long_aligned __attribute__((aligned((sizeof(long)))))
#endif
/* /*
* Less bad way to call ioctl from within the kernel; this needs to be * Less bad way to call ioctl from within the kernel; this needs to be
* done some other way to get the call out of interrupt context. * done some other way to get the call out of interrupt context.
...@@ -138,7 +141,9 @@ struct bond_params { ...@@ -138,7 +141,9 @@ struct bond_params {
struct reciprocal_value reciprocal_packets_per_slave; struct reciprocal_value reciprocal_packets_per_slave;
u16 ad_actor_sys_prio; u16 ad_actor_sys_prio;
u16 ad_user_port_key; u16 ad_user_port_key;
u8 ad_actor_system[ETH_ALEN];
/* 2 bytes of padding : see ether_addr_equal_64bits() */
u8 ad_actor_system[ETH_ALEN + 2];
}; };
struct bond_parm_tbl { struct bond_parm_tbl {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment