This is a note to let you know that I've just added the patch titled net/sched: act_mpls: ensure LSE is pullable before reading it to the 5.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: net-sched-act_mpls-ensure-lse-is-pullable-before-reading-it.patch and it can be found in the queue-5.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Sun Dec 6 10:20:28 AM CET 2020 From: Davide Caratti <dcaratti@xxxxxxxxxx> Date: Thu, 3 Dec 2020 10:37:52 +0100 Subject: net/sched: act_mpls: ensure LSE is pullable before reading it From: Davide Caratti <dcaratti@xxxxxxxxxx> [ Upstream commit 9608fa653059c3f72faab0c148ac8773c46e7314 ] when 'act_mpls' is used to mangle the LSE, the current value is read from the packet dereferencing 4 bytes at mpls_hdr(): ensure that the label is contained in the skb "linear" area. Found by code inspection. v2: - use MPLS_HLEN instead of sizeof(new_lse), thanks to Jakub Kicinski Fixes: 2a2ea50870ba ("net: sched: add mpls manipulation actions to TC") Signed-off-by: Davide Caratti <dcaratti@xxxxxxxxxx> Acked-by: Guillaume Nault <gnault@xxxxxxxxxx> Link: https://lore.kernel.org/r/3243506cba43d14858f3bd21ee0994160e44d64a.1606987058.git.dcaratti@xxxxxxxxxx Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/sched/act_mpls.c | 3 +++ 1 file changed, 3 insertions(+) --- a/net/sched/act_mpls.c +++ b/net/sched/act_mpls.c @@ -88,6 +88,9 @@ static int tcf_mpls_act(struct sk_buff * goto drop; break; case TCA_MPLS_ACT_MODIFY: + if (!pskb_may_pull(skb, + skb_network_offset(skb) + MPLS_HLEN)) + goto drop; new_lse = tcf_mpls_get_lse(mpls_hdr(skb), p, false); if (skb_mpls_update_lse(skb, new_lse)) goto drop; Patches currently in stable-queue which might be from dcaratti@xxxxxxxxxx are queue-5.4/net-openvswitch-ensure-lse-is-pullable-before-reading-it.patch queue-5.4/net-skbuff-ensure-lse-is-pullable-before-decrementing-the-mpls-ttl.patch queue-5.4/net-sched-act_mpls-ensure-lse-is-pullable-before-reading-it.patch