On Fri, Jan 24, 2025 at 07:42:26PM -0500, Aaron Conole wrote:
> Dan Carpenter <dan.carpenter@xxxxxxxxxx> writes:
>
> > If "hlen" less than "cutlen" then when we call upcall_msg_size()
> > the "hlen - cutlen" parameter will be a very high positive
> > number.
> >
> > Later in the function we use "skb->len - cutlen" but this change
> > addresses that potential underflow since skb->len is always going to
> > be greater than or equal to hlen.
> >
> > Fixes: f2a4d086ed4c ("openvswitch: Add packet truncation support.")
> > Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> > ---
> > From code review not testing.
>
> I think it's pretty difficult to trigger this case. 'cutlen' will only
> be set by a TRUNC action attribute, which does a length check there.
>
Ah. Yes. You're right. I assumed that since we neede to do a upper
bounds check on skb->len then probably the lower bounds needed to be
checked too but that's not correct. My bad. No need to do anything
here because the code is fine as-is.
net/openvswitch/actions.c
1402 case OVS_ACTION_ATTR_TRUNC: {
1403 struct ovs_action_trunc *trunc = nla_data(a);
1404
1405 if (skb->len > trunc->max_len)
1406 OVS_CB(skb)->cutlen = skb->len - trunc->max_len;
1407 break;
1408 }
regards,
dan carpenter
