From: Ido Schimmel <idosch@idosch.org>
To: David Ahern <dsahern@gmail.com>
Cc: David Ahern <dsahern@kernel.org>,
netdev@vger.kernel.org,
syzbot+d4b9a2851cc3ce998741@syzkaller.appspotmail.com,
Thomas Graf <tgraf@suug.ch>
Subject: Re: [PATCH net] ipv4: Check attribute length for RTA_GATEWAY
Date: Sun, 12 Dec 2021 10:09:22 +0200 [thread overview]
Message-ID: <YbWuMj3moQ9uShMc@shredder> (raw)
In-Reply-To: <73de092c-e6d0-72d6-3547-b4217076f6f9@gmail.com>
On Sat, Dec 11, 2021 at 03:13:02PM -0700, David Ahern wrote:
> On 12/11/21 12:13 PM, Ido Schimmel wrote:
> > On Sat, Dec 11, 2021 at 09:21:48AM -0700, David Ahern wrote:
> >> syzbot reported uninit-value:
> >> ============================================================
> >> BUG: KMSAN: uninit-value in fib_get_nhs+0xac4/0x1f80
> >> net/ipv4/fib_semantics.c:708
> >> fib_get_nhs+0xac4/0x1f80 net/ipv4/fib_semantics.c:708
> >> fib_create_info+0x2411/0x4870 net/ipv4/fib_semantics.c:1453
> >> fib_table_insert+0x45c/0x3a10 net/ipv4/fib_trie.c:1224
> >> inet_rtm_newroute+0x289/0x420 net/ipv4/fib_frontend.c:886
> >>
> >> Add length checking before using the attribute.
> >>
> >> Fixes: 4e902c57417c ("[IPv4]: FIB configuration using struct fib_config")
> >> Reported-by: syzbot+d4b9a2851cc3ce998741@syzkaller.appspotmail.com
> >> Signed-off-by: David Ahern <dsahern@kernel.org>
> >> Cc: Thomas Graf <tgraf@suug.ch>
> >> ---
> >> I do not have KMSAN setup, so this is based on a code analysis. Before
> >
> > Was using this in the past:
> > https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
>
> thanks for the pointer. I am a bit hardware challenged at the moment for
> out of tree features.
>
> >
> >> 4e902c57417c fib_get_attr32 was checking the attribute length; the
> >> switch to nla_get_u32 does not.
> >>
> >> net/ipv4/fib_semantics.c | 4 ++++
> >> 1 file changed, 4 insertions(+)
> >>
> >> diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
> >> index 3cad543dc747..930843ba3b17 100644
> >> --- a/net/ipv4/fib_semantics.c
> >> +++ b/net/ipv4/fib_semantics.c
> >> @@ -704,6 +704,10 @@ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh,
> >> return -EINVAL;
> >> }
> >> if (nla) {
> >> + if (nla_len(nla) < sizeof(__be32)) {
> >> + NL_SET_ERR_MSG(extack, "Invalid IPv4 address in RTA_GATEWAY");
> >> + return -EINVAL;
> >> + }
> >
> > Isn't the problem more general than that? It seems that there is no
> > minimum length validation to any of the attributes inside RTA_MULTIPATH.
> > Except maybe RTA_VIA
> >
>
> A follow up commit is needed for RTA_FLOW.
The same problem seems to exists in the delete path and IPv6. See
fib_nh_match() and ip6_route_multipath_add(), for example.
prev parent reply other threads:[~2021-12-12 8:09 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-11 16:21 [PATCH net] ipv4: Check attribute length for RTA_GATEWAY David Ahern
2021-12-11 19:13 ` Ido Schimmel
2021-12-11 22:13 ` David Ahern
2021-12-12 8:09 ` Ido Schimmel [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YbWuMj3moQ9uShMc@shredder \
--to=idosch@idosch.org \
--cc=dsahern@gmail.com \
--cc=dsahern@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=syzbot+d4b9a2851cc3ce998741@syzkaller.appspotmail.com \
--cc=tgraf@suug.ch \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).