From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7AA43C433F5 for ; Thu, 6 Oct 2022 20:29:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232017AbiJFU30 (ORCPT ); Thu, 6 Oct 2022 16:29:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37550 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232139AbiJFU3X (ORCPT ); Thu, 6 Oct 2022 16:29:23 -0400 Received: from out1-smtp.messagingengine.com (out1-smtp.messagingengine.com [66.111.4.25]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 10928BEF87 for ; Thu, 6 Oct 2022 13:29:23 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 66BF55C015A; Thu, 6 Oct 2022 16:29:22 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute1.internal (MEProxy); Thu, 06 Oct 2022 16:29:22 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-type:date:date:feedback-id :feedback-id:from:from:in-reply-to:in-reply-to:message-id :mime-version:references:reply-to:sender:subject:subject:to:to :x-me-proxy:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s= fm2; t=1665088162; x=1665174562; bh=uLy5n75toIIJPmhQURl2VFRA4Hy5 q63RNkKn7R+7sqg=; b=r2Pd1iTo1VeFQpnFkHQ9Pbh4O570H5XFc89zq0vJuHgW jKjI2Q+Hg4Ml4U8ih3+8+qT3gyWha03ScUeplo6xCVBXzHhKSrQOnk7E+w5d/cMJ VNMa8ahBF1VD6t+6pu0fTk+P3mAq3+ZIRa8T+VchEgWFXm0+e/8Jo4X3Fn1msZey DlJ/iTpQ3tEr01mLRkkxILNTwbB13/wGwvFp1BzkndK5SypHykZTtVscfLxzqQCb UgOmKbOPBlsNLS28W6hXop6IYwvMVdypAalOIog4efje6H79xzRxdjzBh6wHO06z Quf9+od1XMVB4YCZR2EWiVKq1g+2IN1UbQfmvuJPLQ== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvfedrfeeihedgudeglecutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh necuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmd enucfjughrpeffhffvvefukfhfgggtuggjsehttdertddttddvnecuhfhrohhmpefkugho ucfutghhihhmmhgvlhcuoehiughoshgthhesihguohhstghhrdhorhhgqeenucggtffrrg htthgvrhhnpedvudefveekheeugeeftddvveefgfduieefudeifefgleekheegleegjeej geeghfenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpe hiughoshgthhesihguohhstghhrdhorhhg X-ME-Proxy: Feedback-ID: i494840e7:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 6 Oct 2022 16:29:21 -0400 (EDT) Date: Thu, 6 Oct 2022 23:29:18 +0300 From: Ido Schimmel To: David Ahern Cc: kuba@kernel.org, davem@davemloft.net, pabeni@redhat.com, netdev@vger.kernel.org, Gwangun Jung Subject: Re: [PATCH v3 net] ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference Message-ID: References: <20221006164849.9386-1-dsahern@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20221006164849.9386-1-dsahern@kernel.org> Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Thu, Oct 06, 2022 at 10:48:49AM -0600, David Ahern wrote: > Gwangun Jung reported a slab-out-of-bounds access in fib_nh_match: > fib_nh_match+0xf98/0x1130 linux-6.0-rc7/net/ipv4/fib_semantics.c:961 > fib_table_delete+0x5f3/0xa40 linux-6.0-rc7/net/ipv4/fib_trie.c:1753 > inet_rtm_delroute+0x2b3/0x380 linux-6.0-rc7/net/ipv4/fib_frontend.c:874 > > Separate nexthop objects are mutually exclusive with the legacy > multipath spec. Fix fib_nh_match to return if the config for the > to be deleted route contains a multipath spec while the fib_info > is using a nexthop object. > > Fixes: 493ced1ac47c ("ipv4: Allow routes to use nexthop objects") > Fixes: 6bf92d70e690 ("net: ipv4: fix route with nexthop object delete warning") > Reported-by: Gwangun Jung > Signed-off-by: David Ahern Reviewed-by: Ido Schimmel Tested-by: Ido Schimmel