| From: Eric Dumazet <edumazet@google.com> |
| Date: Sun, 22 Apr 2018 18:29:23 -0700 |
| Subject: ipv6: add RTA_TABLE and RTA_PREFSRC to rtm_ipv6_policy |
| |
| commit aa8f8778493c85fff480cdf8b349b1e1dcb5f243 upstream. |
| |
| KMSAN reported use of uninit-value that I tracked to lack |
| of proper size check on RTA_TABLE attribute. |
| |
| I also believe RTA_PREFSRC lacks a similar check. |
| |
| Fixes: 86872cb57925 ("[IPv6] route: FIB6 configuration using struct fib6_config") |
| Fixes: c3968a857a6b ("ipv6: RTA_PREFSRC support for ipv6 route source address selection") |
| Signed-off-by: Eric Dumazet <edumazet@google.com> |
| Reported-by: syzbot <syzkaller@googlegroups.com> |
| Acked-by: David Ahern <dsahern@gmail.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| [bwh: Backported to 3.16: adjust context] |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| net/ipv6/route.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| --- a/net/ipv6/route.c |
| +++ b/net/ipv6/route.c |
| @@ -2344,11 +2344,13 @@ void rt6_mtu_change(struct net_device *d |
| |
| static const struct nla_policy rtm_ipv6_policy[RTA_MAX+1] = { |
| [RTA_GATEWAY] = { .len = sizeof(struct in6_addr) }, |
| + [RTA_PREFSRC] = { .len = sizeof(struct in6_addr) }, |
| [RTA_OIF] = { .type = NLA_U32 }, |
| [RTA_IIF] = { .type = NLA_U32 }, |
| [RTA_PRIORITY] = { .type = NLA_U32 }, |
| [RTA_METRICS] = { .type = NLA_NESTED }, |
| [RTA_MULTIPATH] = { .len = sizeof(struct rtnexthop) }, |
| + [RTA_TABLE] = { .type = NLA_U32 }, |
| }; |
| |
| static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh, |
