netdev - Re: [PATCH net] ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 3 Jun 2021 09:12:08 -0600
From:   David Ahern <dsahern@...il.com>
To:     Coco Li <lixiaoyan@...gle.com>, netdev@...r.kernel.org
Cc:     David Ahern <dsahern@...nel.org>,
        Eric Dumazet <edumazet@...gle.com>
Subject: Re: [PATCH net] ipv6: Fix KASAN: slab-out-of-bounds Read in
 fib6_nh_flush_exceptions

On 6/3/21 1:32 AM, Coco Li wrote:
> Reported by syzbot:
> HEAD commit:    90c911ad Merge tag 'fixes' of git://git.kernel.org/pub/scm..
> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> dashboard link: https://syzkaller.appspot.com/bug?extid=123aa35098fd3c000eb7
> compiler:       Debian clang version 11.0.1-2
> 
...

> 
> In the ip6_route_info_create function, in the case that the nh pointer
> is not NULL, the fib6_nh in fib6_info has not been allocated.
> Therefore, when trying to free fib6_info in this error case using
> fib6_info_release, the function will call fib6_info_destroy_rcu,
> which it will access fib6_nh_release(f6i->fib6_nh);
> However, f6i->fib6_nh doesn't have any refcount yet given the lack of allocation
> causing the reported memory issue above.
> Therefore, releasing the empty pointer directly instead would be the solution.
> 
> Fixes: f88d8ea67fbdb ("ipv6: Plumb support for nexthop object in a fib6_info")
> Fixes: 706ec91916462 ("ipv6: Fix nexthop refcnt leak when creating ipv6 route info")
> Signed-off-by: Coco Li <lixiaoyan@...gle.com>
> Cc: David Ahern <dsahern@...nel.org>
> Reviewed-by: Eric Dumazet <edumazet@...gle.com>
> ---
>  net/ipv6/route.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 

Reviewed-by: David Ahern <dsahern@...nel.org>