netdev - Re: [PATCH v1 net] ipv6: Move fib6_config_validate() to ip6_route

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89iLK5pzu6B1h16OphYfyH4yKQj1+DANRNVuzG11F+=s5dw@mail.gmail.com>
Date: Thu, 12 Jun 2025 05:13:10 -0700
From: Eric Dumazet <edumazet@...gle.com>
To: Kuniyuki Iwashima <kuni1840@...il.com>
Cc: "David S. Miller" <davem@...emloft.net>, David Ahern <dsahern@...nel.org>, 
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Simon Horman <horms@...nel.org>, 
	Kuniyuki Iwashima <kuniyu@...gle.com>, netdev@...r.kernel.org, 
	syzbot+4c2358694722d304c44e@...kaller.appspotmail.com
Subject: Re: [PATCH v1 net] ipv6: Move fib6_config_validate() to ip6_route_add().

On Wed, Jun 11, 2025 at 12:36 PM Kuniyuki Iwashima <kuni1840@...il.com> wrote:
>
> From: Kuniyuki Iwashima <kuniyu@...gle.com>
>
> syzkaller created an IPv6 route from a malformed packet, which has
> a prefix len > 128, triggering the splat below. [0]
>
> This is a similar issue fixed by commit 586ceac9acb7 ("ipv6: Restore
> fib6_config validation for SIOCADDRT.").
>
> The cited commit removed fib6_config validation from some callers
> of ip6_add_route().
>
> Let's move the validation back to ip6_route_add() and
> ip6_route_multipath_add().
>
> [0]:
> Fixes: fa76c1674f2e ("ipv6: Move some validation from ip6_route_info_create() to rtm_to_fib6_config().")
> Reported-by: syzbot+4c2358694722d304c44e@...kaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/6849b8c3.a00a0220.1eb5f5.00f0.GAE@google.com/
> Signed-off-by: Kuniyuki Iwashima <kuniyu@...gle.com>

Reviewed-by: Eric Dumazet <edumazet@...gle.com>