From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f182.google.com (mail-pf1-f182.google.com [209.85.210.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 56131348445 for ; Sat, 4 Jul 2026 22:22:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783203781; cv=none; b=gjz6F3aR7qmUekooyV9HWv5hsuyC4vZ/5v7TiF+2VElH/2xeTuDbDQT38LW0FMTvvycO4G5jIieHhf7FEYStTWB8P8BK7wRVs+y4jJoIXrXdMXvHBYBtJnXdSmnJPVMU94LPnzsQQB0UeE1dqpN3FWczIbEx5zPUwhZHcJb3Pgg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783203781; c=relaxed/simple; bh=4qvXCceyH6zuN3hy7lanVxkYiDgB7NLTyjSDVr5VmfQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=AaBESTugpWlhzJq+TUj0/GvFYR5wS4L7rOnKAH2x4yZP56dP/1XEGIP7o7gZkk6kEAITd6HTFGMiV2nHm4JzPgvGXqh3mM+hB8T7svMZIqhLevzUtUWieViJU1hGt71qqnMYS7AEjj7bIJKvy6hrz+DEKK/dNIxtTBu3wSaF1h4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu; spf=pass smtp.mailfrom=asu.edu; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b=AsNWhC8k; arc=none smtp.client-ip=209.85.210.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=asu.edu Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b="AsNWhC8k" Received: by mail-pf1-f182.google.com with SMTP id d2e1a72fcca58-847aa193d98so1370145b3a.3 for ; Sat, 04 Jul 2026 15:22:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=asu.edu; s=google; t=1783203779; x=1783808579; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=70dWq0Alk4Cssp1Jlc+lKIuB3dScjeAA+8YF2YRZQ6U=; b=AsNWhC8k7R0WWEKIfGofTKSIDrAPehoeazwfk9psRH118/yAOzV7KIj0JbSrJ5bS7w 3oI6WLy2Sx5L+HYb984Y0AxZjsRF0K2FCMGqUiGOZDqcgg1M5JG8hkwFT3917gXR4lpd IPrtMrf+jz4dmDHXuRjcfsMMn6cSWqdqac9d49oFc8DgJvcgZ3B6jJLxqAuomFTbRqdu CiR6YpTG/E00QSxsy7Q3WQpDQBMEV8pYQNP4dY1cPl9y6rYrMSkjXno5lB7gtPkwlk+4 hjsPce3jAT76Y/ncv5AT9+nzD6ACI+/C6fwob4zAhsJt36QFCcWRvlmtCjjImDDHsxoi e/qQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783203779; x=1783808579; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=70dWq0Alk4Cssp1Jlc+lKIuB3dScjeAA+8YF2YRZQ6U=; b=Jw36CE4TSnypFWpKcSJDjrcPQawuV79reWduYv47X2ZcnglmZYy9V3y+HlDnK/6j7e eNqPiScUfov6hj28SrJtjBB1DmNmZdUdnxPxd2oFFwhixCikdzVgt95BQx8RDx3k7jJj Wfu6aY5yO0hErfX9Xo2JaTxSPrisNSMqtfdeZ2Edo8+aj7wupinLSCCAGkEuHeaQE25k xMS9SdxzhQUBwW/rKQaKye4/BvaNdePFCEw/41lMptT0yav2VU0xwKXcbnmIk+5Td6d6 Ood6mL4NJUhK/7d/YZt1MEl0hCXoadgkwvxb2x6C4N6GJzXSPpcruBA3AsY41eu/oWkV Yc4g== X-Forwarded-Encrypted: i=1; AHgh+Ro+JuB39nzCXksFcpfW8idOwr1G+pzMqpcId1XuFKiCSksKV1JhfRZXJdtNHr5NMb1MM+H56e/a3xSvrHc=@vger.kernel.org X-Gm-Message-State: AOJu0Yw2GVBzatdTQniII5cBi2dLL7o1RxTXtP7hf1L4bTotD8j1x0oZ tQdk6kz5errMar5CWiDuyT5U1jszCAr+5q202YddQ1LOy1YvgEy1P6I6H51MljV+4g== X-Gm-Gg: AfdE7clgkjkFv5A4zBTaG+URvCJNPIrYQufrY4mSL3P+7siJPecz3+HnSIY6HoX4IYP KM9ZPdfK+CC1Eke8LwdcBxlahMP/7YDp6N5pdAb9aNtbucW14/057zDX0cbUuTwlnTCMKv8sxtb WKkLTfRqr8FXCFKl1z+/8HfiyNdCsUXVdP87SIL5XmVyrs3lATno5CiJ3XS3VFrh81m9yNbcuEx JixPOauzPVHlI2VlYISTFsRwR9t2yvRa528XndwIGw14IyqIdzJLL9JA3nnhunm042Dd85BMyRW Of9KrgAJ1ixoG/4Oyilpl92kAHnCOTfksN/Fi32UQEPJnFGGfBmYw/cbaQgzgfSd4/VbbHDmqpy pTceg/JUejIXIG/lQDVkwTDQO1G8qDB0CqBm/OOWjhaTtg9vgTe+yWNLXxjPo9WPHMRuzNGIG6b E= X-Received: by 2002:a05:6a00:1894:b0:847:8625:f7bb with SMTP id d2e1a72fcca58-847f6faa023mr4130520b3a.60.1783203778712; Sat, 04 Jul 2026 15:22:58 -0700 (PDT) Received: from p1.. ([172.56.105.253]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-847f6dbdc8dsm1575890b3a.55.2026.07.04.15.22.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 04 Jul 2026 15:22:58 -0700 (PDT) From: Xiang Mei To: Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Roopa Prabhu Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Petr Machata , Andy Roulin , David Yang , Kees Cook , Weiming Shi , Xiang Mei Subject: [PATCH net] vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes Date: Sat, 4 Jul 2026 15:22:54 -0700 Message-ID: <20260704222254.914567-1-xmei5@asu.edu> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLA_BINARY with only a maximum length, so validate_nla() accepts a payload shorter than the address. The GROUP consumer reads it with nla_get_in_addr(), an unconditional 4-byte load, so a short attribute over-reads up to 3 bytes of uninitialised slab data, which are stored into remote_ip and echoed back via RTM_GETTUNNEL, disclosing kernel memory. Switch both entries to NLA_POLICY_EXACT_LEN() so the validator rejects any GROUP/GROUP6 that is not exactly 4 / 16 bytes; a valid address is always sent at full width. Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata device") Reported-by: Weiming Shi Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei --- drivers/net/vxlan/vxlan_vnifilter.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/net/vxlan/vxlan_vnifilter.c b/drivers/net/vxlan/vxlan_vnifilter.c index 3e76f4e21094..dd94085e0886 100644 --- a/drivers/net/vxlan/vxlan_vnifilter.c +++ b/drivers/net/vxlan/vxlan_vnifilter.c @@ -462,10 +462,8 @@ static int vxlan_vnifilter_dump(struct sk_buff *skb, struct netlink_callback *cb static const struct nla_policy vni_filter_entry_policy[VXLAN_VNIFILTER_ENTRY_MAX + 1] = { [VXLAN_VNIFILTER_ENTRY_START] = { .type = NLA_U32 }, [VXLAN_VNIFILTER_ENTRY_END] = { .type = NLA_U32 }, - [VXLAN_VNIFILTER_ENTRY_GROUP] = { .type = NLA_BINARY, - .len = sizeof_field(struct iphdr, daddr) }, - [VXLAN_VNIFILTER_ENTRY_GROUP6] = { .type = NLA_BINARY, - .len = sizeof(struct in6_addr) }, + [VXLAN_VNIFILTER_ENTRY_GROUP] = NLA_POLICY_EXACT_LEN(sizeof_field(struct iphdr, daddr)), + [VXLAN_VNIFILTER_ENTRY_GROUP6] = NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)), }; static const struct nla_policy vni_filter_policy[VXLAN_VNIFILTER_MAX + 1] = { -- 2.43.0