netdev - Re: [PATCH] net: Fix invalid ip_route_output

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89i+=-BTZyhg9f=Vyz0rws1Z-1O-F5TkESBjkZnKmHeKz1g@mail.gmail.com>
Date:   Mon, 20 Mar 2023 20:17:15 -0700
From:   Eric Dumazet <edumazet@...gle.com>
To:     Hyunwoo Kim <v4bel@...ori.io>
Cc:     Taehee Yoo <ap420073@...il.com>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>, Dmitry Kozlov <xeb@...l.ru>,
        David Ahern <dsahern@...nel.org>, tudordana@...gle.com,
        netdev@...r.kernel.org, imv4bel@...il.com
Subject: Re: [PATCH] net: Fix invalid ip_route_output_ports() call

On Mon, Mar 20, 2023 at 7:49 PM Hyunwoo Kim <v4bel@...ori.io> wrote:
>
> If you pass the address of the struct flowi4 you declared as a
> local variable as the fl4 argument to ip_route_output_ports(),
> the subsequent call to xfrm_state_find() will read the local
> variable by AF_INET6 rather than AF_INET as per policy,
> which could cause it to go out of scope on the kernel stack.
>
> Reported-by: syzbot+ada7c035554bcee65580@...kaller.appspotmail.com

I could not find this syzbot issue, can you provide a link, and a stack trace ?

> Signed-off-by: Hyunwoo Kim <v4bel@...ori.io>
> ---

I find this patch quite strange, to be honest.

It looks like some xfrm bug to me.

A stack trace would be helpful.

Thanks.