• Li RongQing's avatar
    vxlan: fix a out of bounds access in __vxlan_find_mac · 7256eac1
    Li RongQing authored
    The size of all_zeros_mac is 6 byte, but eth_hash() will access the
    8 byte, and KASan reported the below bug:
    
    [ 8596.479031] BUG: KASan: out of bounds access in __vxlan_find_mac+0x24/0x100 at addr ffffffff841514c0
    [ 8596.487647] Read of size 8 by task ip/52820
    [ 8596.490818] Address belongs to variable all_zeros_mac+0x0/0x40
    [ 8596.496051] CPU: 0 PID: 52820 Comm: ip Tainted: G WC 4.1.15 #1
    [ 8596.503520] Hardware name: HP ProLiant DL380p Gen8, BIOS P70 02/10/2014
    [ 8596.509365] ffffffff841514c0 ffff88007450f0b8 ffffffff822fa5e1 0000000000000032
    [ 8596.516112] ffff88007450f150 ffff88007450f138 ffffffff812dd58c ffff88007450f1d8
    [ 8596.522856] ffffffff81113b80 0000000000000282 0000000000000001 ffffffff8101ee4d
    [ 8596.529599] Call Trace:
    [ 8596.530858] [<ffffffff822fa5e1>] dump_stack+0x4f/0x7b
    [ 8596.535080] [<ffffffff812dd58c>] kasan_report_error+0x3bc/0x3f0
    [ 8596.540258] [<ffffffff81113b80>] ? __lock_acquire+0x90/0x2140
    [ 8596.545245] [<ffffffff8101ee4d>] ? save_stack_trace+0x2d/0x80
    [ 8596.550234] [<ffffffff812dda70>] kasan_report+0x40/0x50
    [ 8596.554647] [<ffffffff81b211e4>] ? __vxlan_find_mac+0x24/0x100
    [ 8596.559729] [<ffffffff812dc399>] __asan_load8+0x69/0xa0
    [ 8596.564141] [<ffffffff81b211e4>] __vxlan_find_mac+0x24/0x100
    [ 8596.569033] [<ffffffff81b2683d>] vxlan_fdb_create+0x9d/0x570
    
    it can be fixed by enlarging the all_zeros_mac to 8 byte, although it is
    harmless; eth_hash() will be called in other place with the memory which
    is larger and equal to 8 byte.
    Signed-off-by: default avatarLi RongQing <roy.qing.li@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    7256eac1
vxlan.c 82 KB