diff options
| author | David Ahern <dsahern@gmail.com> | 2019-04-24 10:36:06 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-04-26 11:32:00 -0400 |
| commit | e55449e71aade362aa684bd3222974fed6e2d1c6 (patch) | |
| tree | b01812d1e437b6b18d43b7f02d5c69d043f9a9a2 /net | |
| parent | 950347f5f7e407c9ba46c99f44f133de7539b450 (diff) | |
ipv6: Initialize fib6_result in bpf_ipv6_fib_lookup
fib6_result is not initialized in bpf_ipv6_fib_lookup and potentially
passses garbage to the fib lookup which triggers a KASAN warning:
[ 262.055450] ==================================================================
[ 262.057640] BUG: KASAN: user-memory-access in fib6_rule_suppress+0x4b/0xce
[ 262.059488] Read of size 8 at addr 00000a20000000b0 by task swapper/1/0
[ 262.061238]
[ 262.061673] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.1.0-rc5+ #56
[ 262.063493] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-1 04/01/2014
[ 262.065593] Call Trace:
[ 262.066277] <IRQ>
[ 262.066848] dump_stack+0x7e/0xbb
[ 262.067764] kasan_report+0x18b/0x1b5
[ 262.069921] __asan_load8+0x7f/0x81
[ 262.070879] fib6_rule_suppress+0x4b/0xce
[ 262.071980] fib_rules_lookup+0x275/0x2cd
[ 262.073090] fib6_lookup+0x119/0x218
[ 262.076457] bpf_ipv6_fib_lookup+0x39d/0x664
...
Initialize fib6_result to 0.
Fixes: b1d40991506aa ("ipv6: Rename fib6_multipath_select and pass fib6_result")
Signed-off-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/core/filter.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/core/filter.c b/net/core/filter.c index fa8fb0548217..9d28e7e8a4cb 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -4680,8 +4680,8 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params, { struct in6_addr *src = (struct in6_addr *) params->ipv6_src; struct in6_addr *dst = (struct in6_addr *) params->ipv6_dst; + struct fib6_result res = {}; struct neighbour *neigh; - struct fib6_result res; struct net_device *dev; struct inet6_dev *idev; struct flowi6 fl6; |