diff mbox series

[net-next] ipv6: Initialize fib6_result in bpf_ipv6_fib_lookup

Message ID 20190424173606.12451-1-dsahern@kernel.org
State Accepted
Delegated to: David Miller
Headers show
Series [net-next] ipv6: Initialize fib6_result in bpf_ipv6_fib_lookup | expand

Commit Message

David Ahern April 24, 2019, 5:36 p.m. UTC 
From: David Ahern <dsahern@gmail.com>

fib6_result is not initialized in bpf_ipv6_fib_lookup and potentially
passses garbage to the fib lookup which triggers a KASAN warning:

[  262.055450] ==================================================================
[  262.057640] BUG: KASAN: user-memory-access in fib6_rule_suppress+0x4b/0xce
[  262.059488] Read of size 8 at addr 00000a20000000b0 by task swapper/1/0
[  262.061238]
[  262.061673] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.1.0-rc5+ #56
[  262.063493] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-1 04/01/2014
[  262.065593] Call Trace:
[  262.066277]  <IRQ>
[  262.066848]  dump_stack+0x7e/0xbb
[  262.067764]  kasan_report+0x18b/0x1b5
[  262.069921]  __asan_load8+0x7f/0x81
[  262.070879]  fib6_rule_suppress+0x4b/0xce
[  262.071980]  fib_rules_lookup+0x275/0x2cd
[  262.073090]  fib6_lookup+0x119/0x218
[  262.076457]  bpf_ipv6_fib_lookup+0x39d/0x664
...

Initialize fib6_result to 0.

Fixes: b1d40991506aa ("ipv6: Rename fib6_multipath_select and pass fib6_result")
Signed-off-by: David Ahern <dsahern@gmail.com>
---
 net/core/filter.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

David Miller April 26, 2019, 3:32 p.m. UTC | #1 
From: David Ahern <dsahern@kernel.org>
Date: Wed, 24 Apr 2019 10:36:06 -0700

> From: David Ahern <dsahern@gmail.com>
> 
> fib6_result is not initialized in bpf_ipv6_fib_lookup and potentially
> passses garbage to the fib lookup which triggers a KASAN warning:
 ...
> Initialize fib6_result to 0.
> 
> Fixes: b1d40991506aa ("ipv6: Rename fib6_multipath_select and pass fib6_result")
> Signed-off-by: David Ahern <dsahern@gmail.com>

Applied, thanks David.
diff mbox series

Patch

diff --git a/net/core/filter.c b/net/core/filter.c
index fa8fb0548217..9d28e7e8a4cb 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4680,8 +4680,8 @@  static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
 {
 	struct in6_addr *src = (struct in6_addr *) params->ipv6_src;
 	struct in6_addr *dst = (struct in6_addr *) params->ipv6_dst;
+	struct fib6_result res = {};
 	struct neighbour *neigh;
-	struct fib6_result res;
 	struct net_device *dev;
 	struct inet6_dev *idev;
 	struct flowi6 fl6;