Messages in this thread | | | From | Alexander Potapenko <> | Date | Wed, 31 May 2017 10:56:47 +0200 | Subject | Re: [PATCH] net: rtnetlink: bail out from rtnl_fdb_dump() on parse error |
| |
Hi David,
I've noticed that the upstream patch: https://github.com/torvalds/linux/commit/0ff50e83b5122e836ca492fefb11656b225ac29c contains the KMSAN report and the repro, despite I've put them under the triple dash (IIRC Eric told me I shouldn't bloat the patch descriptions with that information). Did I mess it up somehow?
Alex
On Wed, May 24, 2017 at 9:32 PM, David Miller <davem@davemloft.net> wrote: > From: Alexander Potapenko <glider@google.com> > Date: Tue, 23 May 2017 13:20:28 +0200 > >> rtnl_fdb_dump() failed to check the result of nlmsg_parse(), which led >> to contents of |ifm| being uninitialized because nlh->nlmsglen was too >> small to accommodate |ifm|. The uninitialized data may affect some >> branches and result in unwanted effects, although kernel data doesn't >> seem to leak to the userspace directly. >> >> The bug has been detected with KMSAN and syzkaller. >> >> Signed-off-by: Alexander Potapenko <glider@google.com> > > Applied, thanks.
-- Alexander Potapenko Software Engineer
Google Germany GmbH Erika-Mann-Straße, 33 80636 München
Geschäftsführer: Matthew Scott Sucherman, Paul Terence Manicle Registergericht und -nummer: Hamburg, HRB 86891 Sitz der Gesellschaft: Hamburg
| |