| From: Eric Dumazet <edumazet@google.com> |
| Date: Sat, 7 Apr 2018 13:42:38 -0700 |
| Subject: net: fix rtnh_ok() |
| |
| commit b1993a2de12c9e75c35729e2ffbc3a92d50c0d31 upstream. |
| |
| syzbot reported : |
| |
| BUG: KMSAN: uninit-value in rtnh_ok include/net/nexthop.h:11 [inline] |
| BUG: KMSAN: uninit-value in fib_count_nexthops net/ipv4/fib_semantics.c:469 [inline] |
| BUG: KMSAN: uninit-value in fib_create_info+0x554/0x8d20 net/ipv4/fib_semantics.c:1091 |
| |
| @remaining is an integer, coming from user space. |
| If it is negative we want rtnh_ok() to return false. |
| |
| Fixes: 4e902c57417c ("[IPv4]: FIB configuration using struct fib_config") |
| Signed-off-by: Eric Dumazet <edumazet@google.com> |
| Reported-by: syzbot <syzkaller@googlegroups.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| include/net/nexthop.h | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/include/net/nexthop.h |
| +++ b/include/net/nexthop.h |
| @@ -6,7 +6,7 @@ |
| |
| static inline int rtnh_ok(const struct rtnexthop *rtnh, int remaining) |
| { |
| - return remaining >= sizeof(*rtnh) && |
| + return remaining >= (int)sizeof(*rtnh) && |
| rtnh->rtnh_len >= sizeof(*rtnh) && |
| rtnh->rtnh_len <= remaining; |
| } |
