[PATCH net] net/mlx5e: IPsec, Fix out-of-bounds comparison of neighbour keys

[PATCH net] net/mlx5e: IPsec, Fix out-of-bounds comparison of neighbour keys

[Tariq Toukan]

From: Gal Pressman <gal@nvidia.com>

mlx5e_ipsec_netevent_event() keeps the L2 headers of offloaded tunnel
mode SAs up to date: on every neighbour change it looks for SAs whose
endpoint matches the neighbour's address. The compare width, 4 bytes for
IPv4 or 16 for IPv6, is chosen from the SA's address family, with no
check that the neighbour is of the same family.

An ARP entry only stores a 4-byte key, so with an IPv6 tunnel mode SA
offloaded, any IPv4 neighbour update in the system is compared as if it
were a 16-byte IPv6 address, reading past the end of the object:

  BUG: KASAN: slab-out-of-bounds in mlx5e_ipsec_netevent_event+0x736/0x8d0 [mlx5_core]
  Read of size 4 at addr ff110001260a4ad8 by task swapper/8/0
  Call Trace:
   <IRQ>
   mlx5e_ipsec_netevent_event+0x736/0x8d0 [mlx5_core]
   notifier_call_chain+0x97/0x2b0
   atomic_notifier_call_chain+0x5d/0x130
   neigh_timer_handler+0x35c/0x1140
   call_timer_fn+0x164/0x490
   __run_timers+0x5b9/0x960
   run_timer_softirq+0xf0/0x1d0
   handle_softirqs+0x189/0x8a0
   __irq_exit_rcu+0x10d/0x250
   ...

  Allocated by task 1015:
   __kmalloc_noprof+0x2e6/0x8b0
   ___neigh_create+0xcc9/0x24c0
   ip_finish_output2+0xfc7/0x1e80
   ip_output+0x172/0x3b0
   ip_send_skb+0xa5/0x1b0
   udp_send_skb+0x852/0x10f0
   udp_sendmsg+0x1333/0x2150
   ...

The opposite mix (IPv4 SA with IPv6 neighbour) stays in bounds, but only
the first 32 bits of the IPv6 address are compared, so an unrelated
neighbour can match.

Skip neighbours whose address family doesn't match the SA.

Fixes: 4c24272b4e2b ("net/mlx5e: Listen to ARP events to update IPsec L2 headers in tunnel mode")
Signed-off-by: Gal Pressman <gal@nvidia.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Reviewed-by: Yael Chemla <ychemla@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
index db260e3d1412..e6dd911475e3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
@@ -958,6 +958,9 @@ static int mlx5e_ipsec_netevent_event(struct notifier_block *nb,
 	xa_for_each_marked(&ipsec->sadb, idx, sa_entry, MLX5E_IPSEC_TUNNEL_SA) {
 		attrs = &sa_entry->attrs;
 
+		if (attrs->addrs.family != n->tbl->family)
+			continue;
+
 		if (attrs->addrs.family == AF_INET) {
 			if (!neigh_key_eq32(n, &attrs->addrs.saddr.a4) &&
 			    !neigh_key_eq32(n, &attrs->addrs.daddr.a4))

base-commit: b6ef0d965fe8ce0ee4b4dcb58b3511f83003e42d
-- 
2.44.0

Re: [PATCH net] net/mlx5e: IPsec, Fix out-of-bounds comparison of neighbour keys

[Fernando Fernandez Mancera]

On 10/21/26 8:42 AM, Tariq Toukan wrote:
> From: Gal Pressman <gal@nvidia.com>
> 
> mlx5e_ipsec_netevent_event() keeps the L2 headers of offloaded tunnel
> mode SAs up to date: on every neighbour change it looks for SAs whose
> endpoint matches the neighbour's address. The compare width, 4 bytes for
> IPv4 or 16 for IPv6, is chosen from the SA's address family, with no
> check that the neighbour is of the same family.
> 
> An ARP entry only stores a 4-byte key, so with an IPv6 tunnel mode SA
> offloaded, any IPv4 neighbour update in the system is compared as if it
> were a 16-byte IPv6 address, reading past the end of the object:
> 
>    BUG: KASAN: slab-out-of-bounds in mlx5e_ipsec_netevent_event+0x736/0x8d0 [mlx5_core]
>    Read of size 4 at addr ff110001260a4ad8 by task swapper/8/0
>    Call Trace:
>     <IRQ>
>     mlx5e_ipsec_netevent_event+0x736/0x8d0 [mlx5_core]
>     notifier_call_chain+0x97/0x2b0
>     atomic_notifier_call_chain+0x5d/0x130
>     neigh_timer_handler+0x35c/0x1140
>     call_timer_fn+0x164/0x490
>     __run_timers+0x5b9/0x960
>     run_timer_softirq+0xf0/0x1d0
>     handle_softirqs+0x189/0x8a0
>     __irq_exit_rcu+0x10d/0x250
>     ...
> 
>    Allocated by task 1015:
>     __kmalloc_noprof+0x2e6/0x8b0
>     ___neigh_create+0xcc9/0x24c0
>     ip_finish_output2+0xfc7/0x1e80
>     ip_output+0x172/0x3b0
>     ip_send_skb+0xa5/0x1b0
>     udp_send_skb+0x852/0x10f0
>     udp_sendmsg+0x1333/0x2150
>     ...
> 
> The opposite mix (IPv4 SA with IPv6 neighbour) stays in bounds, but only
> the first 32 bits of the IPv6 address are compared, so an unrelated
> neighbour can match.
> 
> Skip neighbours whose address family doesn't match the SA.
> 
> Fixes: 4c24272b4e2b ("net/mlx5e: Listen to ARP events to update IPsec L2 headers in tunnel mode")
> Signed-off-by: Gal Pressman <gal@nvidia.com>
> Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
> Reviewed-by: Yael Chemla <ychemla@nvidia.com>
> Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>