datapath: flow: fix potential illegal memory access in __parse_flow_nlattrs
authorDaniel Borkmann <dborkman@redhat.com>
Mon, 9 Sep 2013 20:27:27 +0000 (13:27 -0700)
committerJesse Gross <jesse@nicira.com>
Mon, 9 Sep 2013 20:27:27 +0000 (13:27 -0700)
commiteba93614babc0bc5497ccbb4edc18f569a29bee4
treea1a0f2c1b8af82fe4fc14823cd58dc28e8cb4986
parente584f6a8e33e5c3643155af2d0b10975d50e524a
datapath: flow: fix potential illegal memory access in __parse_flow_nlattrs

In function __parse_flow_nlattrs(), we check for condition
(type > OVS_KEY_ATTR_MAX) and if true, print an error, but we do
not return from this function as in other checks. It seems this
has been forgotten, as otherwise, we could access beyond the
memory of ovs_key_lens, which is of ovs_key_lens[OVS_KEY_ATTR_MAX + 1].
Hence, a maliciously prepared nla_type from user space could access
beyond this upper limit.

Introduced by 03f0d916a ("openvswitch: Mega flow implementation").

Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Andy Zhou <azhou@nicira.com>
Signed-off-by: Jesse Gross <jesse@nicira.com>
datapath/flow.c