Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1627203
| From | Dmitry Vyukov <dvyukov@google.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone |
| Date | 2017-04-20 10:40 +0200 |
| Message-ID | <tyfN8-6Do-3@gated-at.bofh.it> (permalink) |
| References | (10 earlier) <txIet-2fd-9@gated-at.bofh.it> <ty0l4-5yM-27@gated-at.bofh.it> <ty0uL-5Cb-41@gated-at.bofh.it> <ty7wd-1ki-7@gated-at.bofh.it> <ty7FT-1nw-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Thu, Apr 20, 2017 at 1:51 AM, David Ahern <dsa@cumulusnetworks.com> wrote: > On 4/19/17 5:47 PM, Cong Wang wrote: >> On Wed, Apr 19, 2017 at 9:12 AM, Andrey Konovalov <andreyknvl@google.com> wrote: >>> >>> Anyway, I just finished simplifying the reproducer. Give this one a try. >> >> Thanks for providing such a minimal reproducer! >> >> The following patch could fix this crash, but I am not 100% sure if we should >> just clear these bits or reject them with an errno. >> >> diff --git a/net/ipv6/route.c b/net/ipv6/route.c >> index 9db14189..cf524c2 100644 >> --- a/net/ipv6/route.c >> +++ b/net/ipv6/route.c >> @@ -2086,7 +2086,7 @@ static struct rt6_info >> *ip6_route_info_create(struct fib6_config *cfg) >> } else >> rt->rt6i_prefsrc.plen = 0; >> >> - rt->rt6i_flags = cfg->fc_flags; >> + rt->rt6i_flags = cfg->fc_flags & ~(RTF_PCPU | RTF_CACHE); >> >> install_route: >> rt->dst.dev = dev; >> > > I sent a patch returning EINVAL if RTF_PCPU is set in fc_flags Andrey, does it fix the other crashes?
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone David Ahern <dsa@cumulusnetworks.com> - 2017-04-19 18:10 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Andrey Konovalov <andreyknvl@google.com> - 2017-04-19 18:20 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone David Ahern <dsa@cumulusnetworks.com> - 2017-04-19 18:30 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Cong Wang <xiyou.wangcong@gmail.com> - 2017-04-20 01:50 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone David Ahern <dsa@cumulusnetworks.com> - 2017-04-20 02:00 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Dmitry Vyukov <dvyukov@google.com> - 2017-04-20 10:40 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Andrey Konovalov <andreyknvl@google.com> - 2017-04-20 14:20 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Andrey Konovalov <andreyknvl@google.com> - 2017-04-20 17:30 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Andrey Konovalov <andreyknvl@google.com> - 2017-04-20 17:40 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Andrey Konovalov <andreyknvl@google.com> - 2017-04-20 18:20 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone David Ahern <dsa@cumulusnetworks.com> - 2017-04-21 16:30 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone David Ahern <dsa@cumulusnetworks.com> - 2017-04-21 20:30 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Eric Dumazet <eric.dumazet@gmail.com> - 2017-04-21 20:50 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone David Ahern <dsa@cumulusnetworks.com> - 2017-04-20 17:40 +0200
csiph-web