[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20250502011550.66510-1-kuniyu@amazon.com>
Date: Thu, 1 May 2025 18:15:28 -0700
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <dsahern@...nel.org>
CC: <davem@...emloft.net>, <edumazet@...gle.com>, <elver@...gle.com>,
<horms@...nel.org>, <justinstitt@...gle.com>, <kees@...nel.org>,
<kuba@...nel.org>, <linux-kernel@...r.kernel.org>, <netdev@...r.kernel.org>,
<pabeni@...hat.com>, <syzbot+8f8024317adff163ec5a@...kaller.appspotmail.com>,
<syzkaller-bugs@...glegroups.com>, <kuniyu@...zon.com>
Subject: Re: [syzbot] [net?] UBSAN: array-index-out-of-bounds in ip6_rt_copy_init
From: David Ahern <dsahern@...nel.org>
Date: Thu, 1 May 2025 14:44:03 -0600
> On 5/1/25 2:12 PM, Kees Cook wrote:
> > static int ip6_rt_type_to_error(u8 fib6_type)
> > {
> > return fib6_prop[fib6_type];
> > }
> >
> > Perhaps some kind of type confusion, as this is being generated through
> > ip6_rt_init_dst_reject(). Is the fib6_type not "valid" on a reject?
>
> fib6_result is initialized to 0 in ip6_pol_route and no setting of
> fib6_type should be > RTN_MAX.
>
> >
> > The reproducer appears to be just absolutely spamming netlink with
> > requests -- it's not at all obvious to me where the fib6_type is even
> > coming from. I think this is already only reachable on the error path
> > (i.e. it's during a "reject", it looks like), so the rt->dst.error is
> > just being set weird.
> >
> > This feels like it's papering over the actual problem:
>
> yes, if fib6_type is > than RTN_MAX we need to understand where that is
> happening.
Sorry, I think this was my mistake,
https://lore.kernel.org/netdev/20250502002616.60759-1-kuniyu@amazon.com/T/#t
and this will fix it.
https://lore.kernel.org/netdev/20250501005335.53683-1-kuniyu@amazon.com/
Thanks!
#syz dup: [syzbot] [net?] WARNING in ipv6_addr_prefix
Powered by blists - more mailing lists