https://github.com/torvalds/linux
Revision c64c0b3cac4c5b8cb093727d2c19743ea3965c0b authored by Eric Dumazet on 22 March 2017, 02:22:28 UTC, committed by David S. Miller on 22 March 2017, 21:15:49 UTC
Alexander reported a KMSAN splat caused by reads of uninitialized
field (tb_id_in) from user provided struct fib_result_nl

It turns out nl_fib_input() sanity tests on user input is a bit
wrong :

User can pretend nlh->nlmsg_len is big enough, but provide
at sendmsg() time a too small buffer.

Reported-by: Alexander Potapenko <glider@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 8c290e6
History
Tip revision: c64c0b3cac4c5b8cb093727d2c19743ea3965c0b authored by Eric Dumazet on 22 March 2017, 02:22:28 UTC
ipv4: provide stronger user input validation in nl_fib_input()
Tip revision: c64c0b3
File Mode Size
Documentation
arch
block
certs
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.cocciconfig -rw-r--r-- 59 bytes
.get_maintainer.ignore -rw-r--r-- 31 bytes
.gitattributes -rw-r--r-- 30 bytes
.gitignore -rw-r--r-- 1.3 KB
.mailmap -rw-r--r-- 7.7 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 96.0 KB
Kbuild -rw-r--r-- 2.8 KB
Kconfig -rw-r--r-- 252 bytes
MAINTAINERS -rw-r--r-- 389.0 KB
Makefile -rw-r--r-- 57.7 KB
README -rw-r--r-- 722 bytes

README

back to top