linux-kernel - Re: [syzbot] [net?] UBSAN: array-index-out-of-bounds in ip6_rt_copy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e1e1fa75-e9c2-4ae7-befb-f3910a349a9f@kernel.org>
Date: Thu, 1 May 2025 14:44:03 -0600
From: David Ahern <dsahern@...nel.org>
To: Kees Cook <kees@...nel.org>
Cc: syzbot <syzbot+8f8024317adff163ec5a@...kaller.appspotmail.com>,
 davem@...emloft.net, edumazet@...gle.com, elver@...gle.com,
 horms@...nel.org, justinstitt@...gle.com, kuba@...nel.org,
 linux-kernel@...r.kernel.org, netdev@...r.kernel.org, pabeni@...hat.com,
 syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [net?] UBSAN: array-index-out-of-bounds in
 ip6_rt_copy_init

On 5/1/25 2:12 PM, Kees Cook wrote:
> static int ip6_rt_type_to_error(u8 fib6_type)
> {
>         return fib6_prop[fib6_type];
> }
> 
> Perhaps some kind of type confusion, as this is being generated through
> ip6_rt_init_dst_reject(). Is the fib6_type not "valid" on a reject?

fib6_result is initialized to 0 in ip6_pol_route and no setting of
fib6_type should be > RTN_MAX.

> 
> The reproducer appears to be just absolutely spamming netlink with
> requests -- it's not at all obvious to me where the fib6_type is even
> coming from. I think this is already only reachable on the error path
> (i.e. it's during a "reject", it looks like), so the rt->dst.error is
> just being set weird.
> 
> This feels like it's papering over the actual problem:

yes, if fib6_type is > than RTN_MAX we need to understand where that is
happening.

> 
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index 96f1621e2381..fba51a42e7ac 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -1092,6 +1092,8 @@ static const int fib6_prop[RTN_MAX + 1] = {
>  
>  static int ip6_rt_type_to_error(u8 fib6_type)
>  {
> +	if (fib6_type > RTN_MAX)
> +		return -EINVAL;
>  	return fib6_prop[fib6_type];
>  }
>  
> 
> -Kees
>