netdev - Re: [PATCH net] ipv6: repair fib6 tree in failure case

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20170820.200731.997277808682483073.davem@davemloft.net>
Date:   Sun, 20 Aug 2017 20:07:31 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     weiwan@...gle.com
Cc:     netdev@...r.kernel.org, edumazet@...gle.com
Subject: Re: [PATCH net] ipv6: repair fib6 tree in failure case

From: Wei Wang <weiwan@...gle.com>
Date: Fri, 18 Aug 2017 17:14:49 -0700

> From: Wei Wang <weiwan@...gle.com>
> 
> In fib6_add(), it is possible that fib6_add_1() picks an intermediate
> node and sets the node's fn->leaf to NULL in order to add this new
> route. However, if fib6_add_rt2node() fails to add the new
> route for some reason, fn->leaf will be left as NULL and could
> potentially cause crash when fn->leaf is accessed in fib6_locate().
> This patch makes sure fib6_repair_tree() is called to properly repair
> fn->leaf in the above failure case.
> 
> Here is the syzkaller reported general protection fault in fib6_locate:
 ...
> Note: there is no "Fixes" tag as this seems to be a bug introduced
> very early.
> 
> Signed-off-by: Wei Wang <weiwan@...gle.com>
> Acked-by: Eric Dumazet <edumazet@...gle.com>

Applied and queued up for -stable.