From: David Ahern <dsahern@kernel.org>
To: netdev@vger.kernel.org
Cc: David Ahern <dsahern@kernel.org>,
syzbot+d4b9a2851cc3ce998741@syzkaller.appspotmail.com,
Thomas Graf <tgraf@suug.ch>
Subject: [PATCH net] ipv4: Check attribute length for RTA_GATEWAY
Date: Sat, 11 Dec 2021 09:21:48 -0700 [thread overview]
Message-ID: <20211211162148.74404-1-dsahern@kernel.org> (raw)
syzbot reported uninit-value:
============================================================
BUG: KMSAN: uninit-value in fib_get_nhs+0xac4/0x1f80
net/ipv4/fib_semantics.c:708
fib_get_nhs+0xac4/0x1f80 net/ipv4/fib_semantics.c:708
fib_create_info+0x2411/0x4870 net/ipv4/fib_semantics.c:1453
fib_table_insert+0x45c/0x3a10 net/ipv4/fib_trie.c:1224
inet_rtm_newroute+0x289/0x420 net/ipv4/fib_frontend.c:886
Add length checking before using the attribute.
Fixes: 4e902c57417c ("[IPv4]: FIB configuration using struct fib_config")
Reported-by: syzbot+d4b9a2851cc3ce998741@syzkaller.appspotmail.com
Signed-off-by: David Ahern <dsahern@kernel.org>
Cc: Thomas Graf <tgraf@suug.ch>
---
I do not have KMSAN setup, so this is based on a code analysis. Before
4e902c57417c fib_get_attr32 was checking the attribute length; the
switch to nla_get_u32 does not.
net/ipv4/fib_semantics.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 3cad543dc747..930843ba3b17 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -704,6 +704,10 @@ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh,
return -EINVAL;
}
if (nla) {
+ if (nla_len(nla) < sizeof(__be32)) {
+ NL_SET_ERR_MSG(extack, "Invalid IPv4 address in RTA_GATEWAY");
+ return -EINVAL;
+ }
fib_cfg.fc_gw4 = nla_get_in_addr(nla);
if (fib_cfg.fc_gw4)
fib_cfg.fc_gw_family = AF_INET;
--
2.24.3 (Apple Git-128)
next reply other threads:[~2021-12-11 16:21 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-11 16:21 David Ahern [this message]
2021-12-11 19:13 ` [PATCH net] ipv4: Check attribute length for RTA_GATEWAY Ido Schimmel
2021-12-11 22:13 ` David Ahern
2021-12-12 8:09 ` Ido Schimmel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211211162148.74404-1-dsahern@kernel.org \
--to=dsahern@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=syzbot+d4b9a2851cc3ce998741@syzkaller.appspotmail.com \
--cc=tgraf@suug.ch \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.