Messages in this thread Patch in this message | | | Date | Wed, 1 Sep 2021 23:21:00 +0300 | Subject | Re: [syzbot] UBSAN: shift-out-of-bounds in xfrm_get_default | From | Pavel Skripkin <> |
| |
On 9/1/21 23:15, syzbot wrote: > Hello, > > syzbot tried to test the proposed patch but the build/boot failed: > > arch/x86/kernel/setup.c:916:6: error: implicit declaration of function 'acpi_mps_check' [-Werror=implicit-function-declaration] > arch/x86/kernel/setup.c:1110:2: error: implicit declaration of function 'acpi_table_upgrade' [-Werror=implicit-function-declaration] > arch/x86/kernel/setup.c:1112:2: error: implicit declaration of function 'acpi_boot_table_init' [-Werror=implicit-function-declaration] > arch/x86/kernel/setup.c:1120:2: error: implicit declaration of function 'early_acpi_boot_init'; did you mean 'early_cpu_init'? [-Werror=implicit-function-declaration] > arch/x86/kernel/setup.c:1162:2: error: implicit declaration of function 'acpi_boot_init' [-Werror=implicit-function-declaration] > > > Tested on: > > commit: 9e9fb765 Merge tag 'net-next-5.15' of git://git.kernel.. > git tree: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git master > dashboard link: https://syzkaller.appspot.com/bug?extid=b2be9dd8ca6f6c73ee2d > compiler: > patch: https://syzkaller.appspot.com/x/patch.diff?x=14a2a34d300000 >
Ok, net-next is also broken....
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git master
With regards, Pavel SkripkinFrom 172c351869e5920630f27d20976b079fca30650c Mon Sep 17 00:00:00 2001 From: Pavel Skripkin <paskripkin@gmail.com> Date: Wed, 1 Sep 2021 21:55:25 +0300 Subject: [PATCH] net: xfrm: fix shift-out-of-bounds in xfrm_get_default
/* ... */
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> --- arch/x86/kernel/setup.c | 1 + net/xfrm/xfrm_user.c | 3 +++ 2 files changed, 4 insertions(+)
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c index da0a4b64880f..c9e3a17b94f9 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c @@ -23,6 +23,7 @@ #include <linux/usb/xhci-dbgp.h> #include <linux/static_call.h> #include <linux/swiotlb.h> +#include <linux/acpi.h> #include <uapi/linux/mount.h> diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index b7b986520dc7..a1dd38525957 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -2007,6 +2007,9 @@ static int xfrm_get_default(struct sk_buff *skb, struct nlmsghdr *nlh, r_up = nlmsg_data(r_nlh); + if (up->dirmask >= XFRM_USERPOLICY_DIRMASK_MAX) + return -EINVAL; + r_up->action = ((net->xfrm.policy_default & (1 << up->dirmask)) >> up->dirmask); r_up->dirmask = up->dirmask; nlmsg_end(r_skb, r_nlh); -- 2.33.0
| |