lkml.org 
[lkml]   [2016]   [Nov]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: net/netlink: another global-out-of-bounds in genl_family_rcv_msg/validate_nla
On Fri, Nov 4, 2016 at 12:22 AM, Cong Wang <xiyou.wangcong@gmail.com> wrote:
> On Thu, Nov 3, 2016 at 4:04 PM, Andrey Konovalov <andreyknvl@google.com> wrote:
>> Hi,
>>
>> I've got the following error report while running the syzkaller fuzzer:
>>
>> BUG: KASAN: global-out-of-bounds in validate_nla+0x49b/0x4e0 at addr
>> ffffffff84452de0
>> Read of size 2 by task syz-executor/19055
>> Address belongs to variable ip_vs_cmd_policy+0x20/0x40
>
> LOL, seems a typo
>
> diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
> index c3c809b..a6e44ef 100644
> --- a/net/netfilter/ipvs/ip_vs_ctl.c
> +++ b/net/netfilter/ipvs/ip_vs_ctl.c
> @@ -2845,7 +2845,7 @@ static struct genl_family ip_vs_genl_family = {
> .hdrsize = 0,
> .name = IPVS_GENL_NAME,
> .version = IPVS_GENL_VERSION,
> - .maxattr = IPVS_CMD_MAX,
> + .maxattr = IPVS_CMD_ATTR_MAX,
> .netnsok = true, /* Make ipvsadm to work on netns */
> };

This fixes the issue for me.

Tested-by: Andrey Konovalov <andreyknvl@google.com>

Thanks again!

\
 
 \ /
  Last update: 2016-11-04 00:37    [W:0.067 / U:0.752 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site