netdev - Fw: [Bug 199637] New: UBSAN: Undefined behaviour in net/ipv4/fib

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 7 May 2018 10:33:45 -0700
From:   Stephen Hemminger <stephen@...workplumber.org>
To:     netdev@...r.kernel.org
Subject: Fw: [Bug 199637] New: UBSAN: Undefined behaviour in
 net/ipv4/fib_trie.c:503:6



Begin forwarded message:

Date: Mon, 07 May 2018 16:07:24 +0000
From: bugzilla-daemon@...zilla.kernel.org
To: stephen@...workplumber.org
Subject: [Bug 199637] New: UBSAN: Undefined behaviour in net/ipv4/fib_trie.c:503:6


https://bugzilla.kernel.org/show_bug.cgi?id=199637

            Bug ID: 199637
           Summary: UBSAN: Undefined behaviour in
                    net/ipv4/fib_trie.c:503:6
           Product: Networking
           Version: 2.5
    Kernel Version: 4.16.7
          Hardware: x86-64
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: IPV4
          Assignee: stephen@...workplumber.org
          Reporter: combuster@...hlinux.us
        Regression: No

After recompiling the 4.16.7 kernel with gcc 8.1, UBSAN reports the following:

[   25.427424]
================================================================================
[   25.429680] UBSAN: Undefined behaviour in net/ipv4/fib_trie.c:503:6
[   25.431920] member access within null pointer of type 'struct tnode'
[   25.434153] CPU: 3 PID: 1 Comm: systemd Not tainted 4.16.7-CUSTOM #1
[   25.436384] Hardware name: Gigabyte Technology Co., Ltd.
H67MA-UD2H-B3/H67MA-UD2H-B3, BIOS F8 03/27/2012
[   25.438647] Call Trace:
[   25.440889]  dump_stack+0x62/0x9f
[   25.443104]  ubsan_epilogue+0x9/0x35
[   25.445293]  handle_null_ptr_deref+0x80/0x90
[   25.447464]  __ubsan_handle_type_mismatch_v1+0x6a/0x80
[   25.449628]  tnode_free+0xce/0x120
[   25.451749]  ? replace+0xa0/0x1f0
[   25.453833]  ? resize+0x4e2/0xb70
[   25.455916]  ? __kmalloc+0x1fe/0x2d0
[   25.457997]  ? tnode_new+0x66/0x160
[   25.460072]  ? fib_insert_alias+0x4a8/0x9e0
[   25.462145]  ? fib_table_insert+0x208/0x690
[   25.464214]  ? fib_magic+0x20c/0x310
[   25.466280]  ? fib_netdev_event+0x81/0x200
[   25.468339]  ? notifier_call_chain+0x63/0x110
[   25.470407]  ? __dev_notify_flags+0xa8/0x170
[   25.472472]  ? dev_change_flags+0x56/0x80
[   25.474538]  ? do_setlink+0x3c2/0x1a00
[   25.476603]  ? fib_magic+0x20c/0x310
[   25.478666]  ? rtnl_setlink+0x129/0x1e0
[   25.480728]  ? rtnetlink_rcv_msg+0x2a4/0x7d0
[   25.482765]  ? rtnetlink_rcv+0x10/0x10
[   25.484757]  ? netlink_rcv_skb+0x6f/0x170
[   25.486741]  ? netlink_unicast+0x1c0/0x2d0
[   25.488716]  ? netlink_sendmsg+0x2c1/0x630
[   25.490661]  ? sock_sendmsg+0x49/0xb0
[   25.492564]  ? SyS_sendto+0x12b/0x1d0
[   25.494449]  ? do_syscall_64+0xad/0x5cc
[   25.496305]  ? page_fault+0x2f/0x50
[   25.498140]  ? entry_SYSCALL_64_after_hwframe+0x3d/0xa2
[   25.499974]
================================================================================

UBSAN reported nothing when the same kernel was compiled with gcc 7.3.1 from
Arch Linux repositories.

I have three more similar reports to make, if I continue to c/p in each I'm
gonna feel like a fuzzbot...

-- 
You are receiving this mail because:
You are the assignee for the bug.