netdev - Re: [syzbot] [net?] UBSAN: array-index-out-of-bounds in ip6_rt_copy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <202505011943.B3A6D3DAF@keescook>
Date: Thu, 1 May 2025 19:43:48 -0700
From: Kees Cook <kees@...nel.org>
To: Kuniyuki Iwashima <kuniyu@...zon.com>
Cc: dsahern@...nel.org, davem@...emloft.net, edumazet@...gle.com,
	elver@...gle.com, horms@...nel.org, justinstitt@...gle.com,
	kuba@...nel.org, linux-kernel@...r.kernel.org,
	netdev@...r.kernel.org, pabeni@...hat.com,
	syzbot+8f8024317adff163ec5a@...kaller.appspotmail.com,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [net?] UBSAN: array-index-out-of-bounds in
 ip6_rt_copy_init

On Thu, May 01, 2025 at 06:15:28PM -0700, Kuniyuki Iwashima wrote:
> From: David Ahern <dsahern@...nel.org>
> Date: Thu, 1 May 2025 14:44:03 -0600
> > On 5/1/25 2:12 PM, Kees Cook wrote:
> > > static int ip6_rt_type_to_error(u8 fib6_type)
> > > {
> > >         return fib6_prop[fib6_type];
> > > }
> > > 
> > > Perhaps some kind of type confusion, as this is being generated through
> > > ip6_rt_init_dst_reject(). Is the fib6_type not "valid" on a reject?
> > 
> > fib6_result is initialized to 0 in ip6_pol_route and no setting of
> > fib6_type should be > RTN_MAX.
> > 
> > > 
> > > The reproducer appears to be just absolutely spamming netlink with
> > > requests -- it's not at all obvious to me where the fib6_type is even
> > > coming from. I think this is already only reachable on the error path
> > > (i.e. it's during a "reject", it looks like), so the rt->dst.error is
> > > just being set weird.
> > > 
> > > This feels like it's papering over the actual problem:
> > 
> > yes, if fib6_type is > than RTN_MAX we need to understand where that is
> > happening.
> 
> Sorry, I think this was my mistake,
> https://lore.kernel.org/netdev/20250502002616.60759-1-kuniyu@amazon.com/T/#t
> 
> and this will fix it.
> https://lore.kernel.org/netdev/20250501005335.53683-1-kuniyu@amazon.com/
> 
> Thanks!
> 
> 
> #syz dup: [syzbot] [net?] WARNING in ipv6_addr_prefix

Ah-ha! Thanks for getting it fixed! :)

-- 
Kees Cook