On 6/1/20 11:51 PM, YueHaibing wrote:
> When update flowi6 daddr in fl6_update_dst() for srcrt, the used index
> of segments should be segments_left minus one per RFC8754
> (section 4.3.1.1) S15 S16. Otherwise it may results in an out-of-bounds
> read.
>
> Reported-by: syzbot+e8c028b62439eac42...@syzkaller.appspotmail.com
> Fixes: 0cb7498f234e ("seg6: fix SRH processing to comply with RFC8754")
> Signed-off-by: YueHaibing <yuehaib...@huawei.com>
> ---
> net/ipv6/exthdrs.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
> index 5a8bbcdcaf2b..f5304bf33ab1 100644
> --- a/net/ipv6/exthdrs.c
> +++ b/net/ipv6/exthdrs.c
> @@ -1353,7 +1353,7 @@ struct in6_addr *fl6_update_dst(struct flowi6 *fl6,
> {
> struct ipv6_sr_hdr *srh = (struct ipv6_sr_hdr *)opt->srcrt;
>
> - fl6->daddr = srh->segments[srh->segments_left];
> + fl6->daddr = srh->segments[srh->segments_left - 1];
> break;
> }
> default:
>
1) Any reason you do not cc the author of the buggy patch ?
I also cced David Lebrun <david.leb...@uclouvain.be> to get more eyes.
2) What happens if segments_left == 0 ?
