Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1630188

Re: net/ipv6: slab-out-of-bounds in ip6_tnl_xmit

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Mon, Apr 24, 2017 at 9:47 AM, Cong Wang <xiyou.wangcong@gmail.com> wrote:
>
> We use ipv4 dst in ip6_tunnel and cast an IPv4 neigh key as an
> IPv6 address...
>
>
>                 neigh = dst_neigh_lookup(skb_dst(skb),
>                                          &ipv6_hdr(skb)->daddr);
>                 if (!neigh)
>                         goto tx_err_link_failure;
>
>                 addr6 = (struct in6_addr *)&neigh->primary_key; // <=== HERE
>                 addr_type = ipv6_addr_type(addr6);
>
>                 if (addr_type == IPV6_ADDR_ANY)
>                         addr6 = &ipv6_hdr(skb)->daddr;
>
>                 memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr));
>
> Also the network header of the skb at this point should be still IPv4?

Please try the attached patch.

I am not sure how we could handle 4in6 case better than just relying on
the config of ip6 tunnel.

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

net/ipv6: slab-out-of-bounds in ip6_tnl_xmit Andrey Konovalov <andreyknvl@google.com> - 2017-04-24 17:10 +0200
  Re: net/ipv6: slab-out-of-bounds in ip6_tnl_xmit Andrey Konovalov <andreyknvl@google.com> - 2017-04-24 18:30 +0200
  Re: net/ipv6: slab-out-of-bounds in ip6_tnl_xmit Cong Wang <xiyou.wangcong@gmail.com> - 2017-04-24 18:50 +0200
    Re: net/ipv6: slab-out-of-bounds in ip6_tnl_xmit Cong Wang <xiyou.wangcong@gmail.com> - 2017-04-25 07:10 +0200
      Re: net/ipv6: slab-out-of-bounds in ip6_tnl_xmit Andrey Konovalov <andreyknvl@google.com> - 2017-04-25 14:40 +0200

csiph-web