linux-cve-announce - CVE-2025-38324: mpls: Use rcu_dereference_rtnl() in mpls_route_input

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2025071032-CVE-2025-38324-1d1d@gregkh>
Date: Thu, 10 Jul 2025 10:15:32 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38324: mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().

As syzbot reported [0], mpls_route_input_rcu() can be called
from mpls_getroute(), where is under RTNL.

net->mpls.platform_label is only updated under RTNL.

Let's use rcu_dereference_rtnl() in mpls_route_input_rcu() to
silence the splat.

[0]:
WARNING: suspicious RCU usage
6.15.0-rc7-syzkaller-00082-g5cdb2c77c4c3 #0 Not tainted
 ----------------------------
net/mpls/af_mpls.c:84 suspicious rcu_dereference_check() usage!

other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1
1 lock held by syz.2.4451/17730:
 #0: ffffffff9012a3e8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
 #0: ffffffff9012a3e8 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x371/0xe90 net/core/rtnetlink.c:6961

stack backtrace:
CPU: 1 UID: 0 PID: 17730 Comm: syz.2.4451 Not tainted 6.15.0-rc7-syzkaller-00082-g5cdb2c77c4c3 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
 lockdep_rcu_suspicious+0x166/0x260 kernel/locking/lockdep.c:6865
 mpls_route_input_rcu+0x1d4/0x200 net/mpls/af_mpls.c:84
 mpls_getroute+0x621/0x1ea0 net/mpls/af_mpls.c:2381
 rtnetlink_rcv_msg+0x3c9/0xe90 net/core/rtnetlink.c:6964
 netlink_rcv_skb+0x16d/0x440 net/netlink/af_netlink.c:2534
 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
 netlink_unicast+0x53a/0x7f0 net/netlink/af_netlink.c:1339
 netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1883
 sock_sendmsg_nosec net/socket.c:712 [inline]
 __sock_sendmsg net/socket.c:727 [inline]
 ____sys_sendmsg+0xa98/0xc70 net/socket.c:2566
 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2620
 __sys_sendmmsg+0x200/0x420 net/socket.c:2709
 __do_sys_sendmmsg net/socket.c:2736 [inline]
 __se_sys_sendmmsg net/socket.c:2733 [inline]
 __x64_sys_sendmmsg+0x9c/0x100 net/socket.c:2733
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x230 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0a2818e969
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f0a28f52038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00007f0a283b5fa0 RCX: 00007f0a2818e969
RDX: 0000000000000003 RSI: 0000200000000080 RDI: 0000000000000003
RBP: 00007f0a28210ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f0a283b5fa0 R15: 00007ffce5e9f268
 </TASK>

The Linux kernel CVE team has assigned CVE-2025-38324 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.1 with commit 0189197f441602acdca3f97750d392a895b778fd and fixed in 5.4.295 with commit 2919297b18e5a5fb7e643f9e32c12c0b17cce1be
	Issue introduced in 4.1 with commit 0189197f441602acdca3f97750d392a895b778fd and fixed in 5.10.239 with commit 36af82f25fbdcd719eb947c15ea874bf80bcf229
	Issue introduced in 4.1 with commit 0189197f441602acdca3f97750d392a895b778fd and fixed in 5.15.186 with commit d8cd847fb8626872631cc22d44be5127b4ebfb74
	Issue introduced in 4.1 with commit 0189197f441602acdca3f97750d392a895b778fd and fixed in 6.1.142 with commit 49b8a9d7d44401a186e20b1aaf591d2e62727aeb
	Issue introduced in 4.1 with commit 0189197f441602acdca3f97750d392a895b778fd and fixed in 6.6.95 with commit a060781640012d5d5105072f4c44ed6ad6830ef9
	Issue introduced in 4.1 with commit 0189197f441602acdca3f97750d392a895b778fd and fixed in 6.12.35 with commit 517bc6836ee9fcffe2539f6f6aa3fdd9c7a7ae73
	Issue introduced in 4.1 with commit 0189197f441602acdca3f97750d392a895b778fd and fixed in 6.15.4 with commit f19cbd84e645e39bc3228e1191bb151ef0ffac8c
	Issue introduced in 4.1 with commit 0189197f441602acdca3f97750d392a895b778fd and fixed in 6.16-rc3 with commit 6dbb0d97c5096072c78a6abffe393584e57ae945

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38324
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/mpls/af_mpls.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/2919297b18e5a5fb7e643f9e32c12c0b17cce1be
	https://git.kernel.org/stable/c/36af82f25fbdcd719eb947c15ea874bf80bcf229
	https://git.kernel.org/stable/c/d8cd847fb8626872631cc22d44be5127b4ebfb74
	https://git.kernel.org/stable/c/49b8a9d7d44401a186e20b1aaf591d2e62727aeb
	https://git.kernel.org/stable/c/a060781640012d5d5105072f4c44ed6ad6830ef9
	https://git.kernel.org/stable/c/517bc6836ee9fcffe2539f6f6aa3fdd9c7a7ae73
	https://git.kernel.org/stable/c/f19cbd84e645e39bc3228e1191bb151ef0ffac8c
	https://git.kernel.org/stable/c/6dbb0d97c5096072c78a6abffe393584e57ae945