Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1627404
| From | Andrey Konovalov <andreyknvl@google.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone |
| Date | 2017-04-20 14:20 +0200 |
| Message-ID | <tyje1-o7-15@gated-at.bofh.it> (permalink) |
| References | (11 earlier) <ty0l4-5yM-27@gated-at.bofh.it> <ty0uL-5Cb-41@gated-at.bofh.it> <ty7wd-1ki-7@gated-at.bofh.it> <ty7FT-1nw-3@gated-at.bofh.it> <tyfN8-6Do-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Thu, Apr 20, 2017 at 10:35 AM, Dmitry Vyukov <dvyukov@google.com> wrote: > On Thu, Apr 20, 2017 at 1:51 AM, David Ahern <dsa@cumulusnetworks.com> wrote: >> On 4/19/17 5:47 PM, Cong Wang wrote: >>> On Wed, Apr 19, 2017 at 9:12 AM, Andrey Konovalov <andreyknvl@google.com> wrote: >>>> >>>> Anyway, I just finished simplifying the reproducer. Give this one a try. >>> >>> Thanks for providing such a minimal reproducer! >>> >>> The following patch could fix this crash, but I am not 100% sure if we should >>> just clear these bits or reject them with an errno. >>> >>> diff --git a/net/ipv6/route.c b/net/ipv6/route.c >>> index 9db14189..cf524c2 100644 >>> --- a/net/ipv6/route.c >>> +++ b/net/ipv6/route.c >>> @@ -2086,7 +2086,7 @@ static struct rt6_info >>> *ip6_route_info_create(struct fib6_config *cfg) >>> } else >>> rt->rt6i_prefsrc.plen = 0; >>> >>> - rt->rt6i_flags = cfg->fc_flags; >>> + rt->rt6i_flags = cfg->fc_flags & ~(RTF_PCPU | RTF_CACHE); >>> >>> install_route: >>> rt->dst.dev = dev; >>> >> >> I sent a patch returning EINVAL if RTF_PCPU is set in fc_flags > > > Andrey, does it fix the other crashes? No, still see them. I'm working on reproducing those.
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone David Ahern <dsa@cumulusnetworks.com> - 2017-04-19 18:10 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Andrey Konovalov <andreyknvl@google.com> - 2017-04-19 18:20 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone David Ahern <dsa@cumulusnetworks.com> - 2017-04-19 18:30 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Cong Wang <xiyou.wangcong@gmail.com> - 2017-04-20 01:50 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone David Ahern <dsa@cumulusnetworks.com> - 2017-04-20 02:00 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Dmitry Vyukov <dvyukov@google.com> - 2017-04-20 10:40 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Andrey Konovalov <andreyknvl@google.com> - 2017-04-20 14:20 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Andrey Konovalov <andreyknvl@google.com> - 2017-04-20 17:30 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Andrey Konovalov <andreyknvl@google.com> - 2017-04-20 17:40 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Andrey Konovalov <andreyknvl@google.com> - 2017-04-20 18:20 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone David Ahern <dsa@cumulusnetworks.com> - 2017-04-21 16:30 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone David Ahern <dsa@cumulusnetworks.com> - 2017-04-21 20:30 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Eric Dumazet <eric.dumazet@gmail.com> - 2017-04-21 20:50 +0200
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone David Ahern <dsa@cumulusnetworks.com> - 2017-04-20 17:40 +0200
csiph-web