lkml.org 
[lkml]   [2018]   [Apr]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.18 22/24] ipv6: add RTA_TABLE and RTA_PREFSRC to rtm_ipv6_policy
    Date
    3.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Eric Dumazet <edumazet@google.com>


    [ Upstream commit aa8f8778493c85fff480cdf8b349b1e1dcb5f243 ]

    KMSAN reported use of uninit-value that I tracked to lack
    of proper size check on RTA_TABLE attribute.

    I also believe RTA_PREFSRC lacks a similar check.

    Fixes: 86872cb57925 ("[IPv6] route: FIB6 configuration using struct fib6_config")
    Fixes: c3968a857a6b ("ipv6: RTA_PREFSRC support for ipv6 route source address selection")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Reported-by: syzbot <syzkaller@googlegroups.com>
    Acked-by: David Ahern <dsahern@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/ipv6/route.c | 2 ++
    1 file changed, 2 insertions(+)

    --- a/net/ipv6/route.c
    +++ b/net/ipv6/route.c
    @@ -2333,11 +2333,13 @@ void rt6_mtu_change(struct net_device *d

    static const struct nla_policy rtm_ipv6_policy[RTA_MAX+1] = {
    [RTA_GATEWAY] = { .len = sizeof(struct in6_addr) },
    + [RTA_PREFSRC] = { .len = sizeof(struct in6_addr) },
    [RTA_OIF] = { .type = NLA_U32 },
    [RTA_IIF] = { .type = NLA_U32 },
    [RTA_PRIORITY] = { .type = NLA_U32 },
    [RTA_METRICS] = { .type = NLA_NESTED },
    [RTA_MULTIPATH] = { .len = sizeof(struct rtnexthop) },
    + [RTA_TABLE] = { .type = NLA_U32 },
    };

    static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,

    \
     
     \ /
      Last update: 2018-04-27 17:35    [W:4.168 / U:25.144 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site