Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 125d91f0 authored by David Ahern's avatar David Ahern Committed by Greg Kroah-Hartman
Browse files

ipv4: Check attribute length for RTA_GATEWAY in multipath route 



commit 7a3429bace0e08d94c39245631ea6bc109dafa49 upstream.

syzbot reported uninit-value:
============================================================
  BUG: KMSAN: uninit-value in fib_get_nhs+0xac4/0x1f80
  net/ipv4/fib_semantics.c:708
   fib_get_nhs+0xac4/0x1f80 net/ipv4/fib_semantics.c:708
   fib_create_info+0x2411/0x4870 net/ipv4/fib_semantics.c:1453
   fib_table_insert+0x45c/0x3a10 net/ipv4/fib_trie.c:1224
   inet_rtm_newroute+0x289/0x420 net/ipv4/fib_frontend.c:886

Add helper to validate RTA_GATEWAY length before using the attribute.

Fixes: 4e902c57 ("[IPv4]: FIB configuration using struct fib_config")
Reported-by: default avatar <syzbot+d4b9a2851cc3ce998741@syzkaller.appspotmail.com>
Signed-off-by: default avatarDavid Ahern <dsahern@kernel.org>
Cc: Thomas Graf <tgraf@suug.ch>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 1f467218

net/ipv4/fib_semantics.c

+26 −3
Original line number Diff line number Diff line
@@ -654,6 +654,19 @@ static int fib_count_nexthops(struct rtnexthop *rtnh, int remaining, 
	return nhs;

}



static int fib_gw_from_attr(__be32 *gw, struct nlattr *nla,

			    struct netlink_ext_ack *extack)

{

	if (nla_len(nla) < sizeof(*gw)) {

		NL_SET_ERR_MSG(extack, "Invalid IPv4 address in RTA_GATEWAY");

		return -EINVAL;

	}



	*gw = nla_get_in_addr(nla);



	return 0;

}



/* only called when fib_nh is integrated into fib_info */

static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh,

		       int remaining, struct fib_config *cfg,
@@ -696,7 +709,11 @@ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh, 
				return -EINVAL;

			}

			if (nla) {

				fib_cfg.fc_gw4 = nla_get_in_addr(nla);

				ret = fib_gw_from_attr(&fib_cfg.fc_gw4, nla,

						       extack);

				if (ret)

					goto errout;



				if (fib_cfg.fc_gw4)

					fib_cfg.fc_gw_family = AF_INET;

			} else if (nlav) {
@@ -894,6 +911,7 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi, 
		attrlen = rtnh_attrlen(rtnh);

		if (attrlen > 0) {

			struct nlattr *nla, *nlav, *attrs = rtnh_attrs(rtnh);

			int err;



			nla = nla_find(attrs, attrlen, RTA_GATEWAY);

			nlav = nla_find(attrs, attrlen, RTA_VIA);
@@ -904,12 +922,17 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi, 
			}



			if (nla) {

				__be32 gw;



				err = fib_gw_from_attr(&gw, nla, extack);

				if (err)

					return err;



				if (nh->fib_nh_gw_family != AF_INET ||

				    nla_get_in_addr(nla) != nh->fib_nh_gw4)

				    gw != nh->fib_nh_gw4)

					return 1;

			} else if (nlav) {

				struct fib_config cfg2;

				int err;



				err = fib_gw_from_via(&cfg2, nlav, extack);

				if (err)