All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, linmiaohe <linmiaohe@huawei.com>,
	"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.20 10/52] net: sit: fix UBSAN Undefined behaviour in check_6rd
Date: Mon, 18 Mar 2019 10:24:57 +0100	[thread overview]
Message-ID: <20190318083844.630445872@linuxfoundation.org> (raw)
In-Reply-To: <20190318083843.398913295@linuxfoundation.org>

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Miaohe Lin <linmiaohe@huawei.com>

[ Upstream commit a843dc4ebaecd15fca1f4d35a97210f72ea1473b ]

In func check_6rd,tunnel->ip6rd.relay_prefixlen may equal to
32,so UBSAN complain about it.

UBSAN: Undefined behaviour in net/ipv6/sit.c:781:47
shift exponent 32 is too large for 32-bit type 'unsigned int'
CPU: 6 PID: 20036 Comm: syz-executor.0 Not tainted 4.19.27 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1
04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xca/0x13e lib/dump_stack.c:113
ubsan_epilogue+0xe/0x81 lib/ubsan.c:159
__ubsan_handle_shift_out_of_bounds+0x293/0x2e8 lib/ubsan.c:425
check_6rd.constprop.9+0x433/0x4e0 net/ipv6/sit.c:781
try_6rd net/ipv6/sit.c:806 [inline]
ipip6_tunnel_xmit net/ipv6/sit.c:866 [inline]
sit_tunnel_xmit+0x141c/0x2720 net/ipv6/sit.c:1033
__netdev_start_xmit include/linux/netdevice.h:4300 [inline]
netdev_start_xmit include/linux/netdevice.h:4309 [inline]
xmit_one net/core/dev.c:3243 [inline]
dev_hard_start_xmit+0x17c/0x780 net/core/dev.c:3259
__dev_queue_xmit+0x1656/0x2500 net/core/dev.c:3829
neigh_output include/net/neighbour.h:501 [inline]
ip6_finish_output2+0xa36/0x2290 net/ipv6/ip6_output.c:120
ip6_finish_output+0x3e7/0xa20 net/ipv6/ip6_output.c:154
NF_HOOK_COND include/linux/netfilter.h:278 [inline]
ip6_output+0x1e2/0x720 net/ipv6/ip6_output.c:171
dst_output include/net/dst.h:444 [inline]
ip6_local_out+0x99/0x170 net/ipv6/output_core.c:176
ip6_send_skb+0x9d/0x2f0 net/ipv6/ip6_output.c:1697
ip6_push_pending_frames+0xc0/0x100 net/ipv6/ip6_output.c:1717
rawv6_push_pending_frames net/ipv6/raw.c:616 [inline]
rawv6_sendmsg+0x2435/0x3530 net/ipv6/raw.c:946
inet_sendmsg+0xf8/0x5c0 net/ipv4/af_inet.c:798
sock_sendmsg_nosec net/socket.c:621 [inline]
sock_sendmsg+0xc8/0x110 net/socket.c:631
___sys_sendmsg+0x6cf/0x890 net/socket.c:2114
__sys_sendmsg+0xf0/0x1b0 net/socket.c:2152
do_syscall_64+0xc8/0x580 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe

Signed-off-by: linmiaohe <linmiaohe@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/sit.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -778,8 +778,9 @@ static bool check_6rd(struct ip_tunnel *
 		pbw0 = tunnel->ip6rd.prefixlen >> 5;
 		pbi0 = tunnel->ip6rd.prefixlen & 0x1f;
 
-		d = (ntohl(v6dst->s6_addr32[pbw0]) << pbi0) >>
-		    tunnel->ip6rd.relay_prefixlen;
+		d = tunnel->ip6rd.relay_prefixlen < 32 ?
+			(ntohl(v6dst->s6_addr32[pbw0]) << pbi0) >>
+		    tunnel->ip6rd.relay_prefixlen : 0;
 
 		pbi1 = pbi0 - tunnel->ip6rd.relay_prefixlen;
 		if (pbi1 > 0)



  parent reply	other threads:[~2019-03-18  9:31 UTC|newest]

Thread overview: 57+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-03-18  9:24 [PATCH 4.20 00/52] 4.20.17-stable review Greg Kroah-Hartman
2019-03-18  9:24 ` [PATCH 4.20 01/52] connector: fix unsafe usage of ->real_parent Greg Kroah-Hartman
2019-03-18  9:24 ` [PATCH 4.20 02/52] gro_cells: make sure device is up in gro_cells_receive() Greg Kroah-Hartman
2019-03-18  9:24 ` [PATCH 4.20 03/52] ipv4/route: fail early when inet dev is missing Greg Kroah-Hartman
2019-03-18  9:24 ` [PATCH 4.20 04/52] l2tp: fix infoleak in l2tp_ip6_recvmsg() Greg Kroah-Hartman
2019-03-18  9:24 ` [PATCH 4.20 05/52] lan743x: Fix RX Kernel Panic Greg Kroah-Hartman
2019-03-18  9:24 ` [PATCH 4.20 06/52] lan743x: Fix TX Stall Issue Greg Kroah-Hartman
2019-03-18  9:24 ` [PATCH 4.20 07/52] net: hns3: add dma_rmb() for rx description Greg Kroah-Hartman
2019-03-18  9:24 ` [PATCH 4.20 08/52] net: hsr: fix memory leak in hsr_dev_finalize() Greg Kroah-Hartman
2019-03-18  9:24 ` [PATCH 4.20 09/52] net/hsr: fix possible crash in add_timer() Greg Kroah-Hartman
2019-03-18  9:24 ` Greg Kroah-Hartman [this message]
2019-03-18  9:24 ` [PATCH 4.20 11/52] net/x25: fix use-after-free in x25_device_event() Greg Kroah-Hartman
2019-03-18  9:24 ` [PATCH 4.20 12/52] net/x25: reset state in x25_connect() Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 13/52] pptp: dst_release sk_dst_cache in pptp_sock_destruct Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 14/52] ravb: Decrease TxFIFO depth of Q3 and Q2 to one Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 15/52] route: set the deleted fnhe fnhe_daddr to 0 in ip_del_fnhe to fix a race Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 16/52] rxrpc: Fix client call queueing, waiting for channel Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 17/52] sctp: remove sched init from sctp_stream_init Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 18/52] tcp: do not report TCP_CM_INQ of 0 for closed connections Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 19/52] tcp: Dont access TCP_SKB_CB before initializing it Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 20/52] tcp: handle inet_csk_reqsk_queue_add() failures Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 21/52] vxlan: Fix GRO cells race condition between receive and link delete Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 22/52] vxlan: test dev->flags & IFF_UP before calling gro_cells_receive() Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 23/52] net/mlx4_core: Fix reset flow when in command polling mode Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 24/52] net/mlx4_core: Fix locking in SRIOV mode when switching between events and polling Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 25/52] net/mlx4_core: Fix qp mtt size calculation Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 26/52] net: sched: flower: insert new filter to idr after setting its mask Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 27/52] tcp: repaired skbs must init their tso_segs Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 28/52] net/x25: fix a race in x25_bind() Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 29/52] mdio_bus: Fix use-after-free on device_register fails Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 30/52] net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255 Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 31/52] ipv6: route: purge exception on removal Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 32/52] team: use operstate consistently for linkup Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 33/52] ipvlan: disallow userns cap_net_admin to change global mode/flags Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 34/52] ipv6: route: enforce RCU protection in rt6_update_exception_stamp_rt() Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 35/52] ipv6: route: enforce RCU protection in ip6_route_check_nh_onlink() Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 36/52] bonding: fix PACKET_ORIGDEV regression Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 37/52] net/smc: fix smc_poll in SMC_INIT state Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 38/52] missing barriers in some of unix_sock ->addr and ->path accesses Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 39/52] f2fs: wait on atomic writes to count F2FS_CP_WB_DATA Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 40/52] perf/x86: Fixup typo in stub functions Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 41/52] ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against Liquid Saffire 56 Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 42/52] ALSA: firewire-motu: fix construction of PCM frame for capture direction Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 43/52] ALSA: hda: Extend i915 component bind timeout Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 44/52] ALSA: hda - add more quirks for HP Z2 G4 and HP Z240 Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 45/52] ALSA: hda/realtek: Enable audio jacks of ASUS UX362FA with ALC294 Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 46/52] ALSA: hda/realtek - Reduce click noise on Dell Precision 5820 headphone Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 47/52] ALSA: hda/realtek: Enable headset MIC of Acer TravelMate X514-51T with ALC255 Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 48/52] perf/x86/intel: Fix memory corruption Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 49/52] perf/x86/intel: Make dev_attr_allow_tsx_force_abort static Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 50/52] Its wrong to add len to sector_nr in raid10 reshape twice Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 51/52] drm: Block fb changes for async plane updates Greg Kroah-Hartman
2019-03-18  9:25 ` [PATCH 4.20 52/52] vhost/vsock: fix vhost vsock cid hashing inconsistent Greg Kroah-Hartman
2019-03-19  2:26 ` [PATCH 4.20 00/52] 4.20.17-stable review Guenter Roeck
2019-03-19  2:52 ` Naresh Kamboju
2019-03-19 10:34 ` Jon Hunter
2019-03-19 10:34   ` Jon Hunter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190318083844.630445872@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=davem@davemloft.net \
    --cc=linmiaohe@huawei.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.