Re: [PATCH net] gve: fix out-of-bounds read in gve_get_flow_rule_entry()

[Eugene Lee]

> gve_get_flow_rule_entry() checks the requested location against the
> first and last cached rules, but rules_cache_num can be 0 while
> rules_cache_synced is true: GVE_FLOW_RULE_QUERY_RULES returns the rules
> from the requested location onwards, so a request past the last
> installed rule - or any request when no rules are installed - returns
> zero rules, which the driver accepts and marks as synced.
>
> The next query evaluates rules_cache[*cache_num - 1] with
> *cache_num == 0. The zero-initialised cache does not trip the earlier
> comparison, *cache_num - 1 wraps to 0xFFFFFFFF in u32, and the read
> faults about 352 GiB past the cache. ETHTOOL_GRXCLSRULE needs no
> capability, so an unprivileged user can trigger it:
>
> BUG: unable to handle page fault for address: ff240996c4c64fa8
> #PF: supervisor read access in kernel mode
> RIP: gve_get_flow_rule_entry+0xd4/0x110 [gve]
>
> Treat an empty cache as a cache miss and re-query.

Patch looks great! I had this exact fix queued up internally along with
a regression test after reproducing the crash.

Reviewed-by: Eugene Lee <eugenehlee@xxxxxxxxxx>
Tested-by: Eugene Lee <eugenehlee@xxxxxxxxxx>