Subject: Re: [PATCH net] rtnetlink: Refine sanity checks in rtnl_fdb_{add|del}

From: Ido Schimmel <[email-masked]>
Date: Fri, 30 Nov 2018 16:58:32 +0200

On Fri, Nov 30, 2018 at 05:35:01AM -0800, 'Eric Dumazet' via syzkaller wrote:
> Commit da71577545a5 ("rtnetlink: Disallow FDB configuration
> for non-Ethernet device") added a test against dev->type.
> 
> kmsan was still able to trigger a kernel-infoleak using a gre device,
> with a correct device type (ARPHRD_ETHER), but with a not
> correct dev->addr_len (4 bytes instead of the expected 6 bytes)

Hi,

Can you please share the reproducer (assuming it exists)? I don't really
understand the fix. None of the functions you patched are in the trace.
Also, looking at IPv4 GRE code, while GRE device has dev->addr_len set
to 4, dev->type is set to ARPHRD_IPGRE.

Thanks