Message-ID: <CALAgD-61-PHPuazoRmBRe7KFDTrnr4mwn5vg8fU2rRMjWUw2kA@mail.gmail.com>
Date: Wed, 28 Aug 2024 21:41:37 -0700
From: Xingyu Li <xli399@....edu>
To: davem@...emloft.net, dsahern@...nel.org, edumazet@...gle.com, 
	kuba@...nel.org, pabeni@...hat.com, netdev@...r.kernel.org, 
	linux-kernel@...r.kernel.org, Yu Hao <yhao016@....edu>
Subject: Re: BUG: general protection fault in batadv_bla_del_backbone_claims

Here is the C reproducer:
https://gist.github.com/freexxxyyy/b5d77fc4396caf3b79d88fb2a12ef0ff

On Fri, Aug 23, 2024 at 7:10 PM Xingyu Li <xli399@....edu> wrote:
>
> Hello,
>
> We found the following issue using syzkaller on Linux v6.10.
>
> It seems to be a null pointer dereference bug
> Need to check the `fi==NULL` before 'fi->fib_dead' on line 1587 of
> net/ipv4/fib_trie.c
>
> The bug report is:
>
> Oops: general protection fault, probably for non-canonical address
> 0xdffffc0000000008: 0000 [#1] PREEMPT SMP KASAN PTI
> KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
> CPU: 0 PID: 9032 Comm: syz.0.15 Not tainted 6.10.0 #13
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> RIP: 0010:fib_table_lookup+0x709/0x1790 net/ipv4/fib_trie.c:1587
> Code: 38 f3 75 4c e8 38 b9 15 f8 49 be 00 00 00 00 00 fc ff df eb 05
> e8 27 b9 15 f8 48 8b 44 24 20 48 8d 58 44 48 89 d8 48 c1 e8 03 <42> 8a
> 04 30 84 c0 0f 85 76 03 00 00 0f b6 1b 31 ff 89 de e8 df bb
> RSP: 0018:ffffc90004acf020 EFLAGS: 00010203
> RAX: 0000000000000008 RBX: 0000000000000044 RCX: ffff88801db88000
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> RBP: ffffc90004acf170 R08: ffffffff897b97ee R09: 1ffffffff221f8b0
> R10: dffffc0000000000 R11: fffffbfff221f8b1 R12: 1ffff11003b1bbe6
> R13: ffff88801d8ddf20 R14: dffffc0000000000 R15: ffff88801d8ddf30
> FS:  0000000000000000(0000) GS:ffff888063a00000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f0cfb3b48d0 CR3: 000000001811e000 CR4: 0000000000350ef0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
>  <TASK>
>  __inet_dev_addr_type+0x2e9/0x510 net/ipv4/fib_frontend.c:225
>  inet_addr_type_dev_table net/ipv4/fib_frontend.c:267 [inline]
>  fib_del_ifaddr+0x1114/0x14b0 net/ipv4/fib_frontend.c:1320
>  fib_inetaddr_event+0xcc/0x1f0 net/ipv4/fib_frontend.c:1448
>  notifier_call_chain kernel/notifier.c:93 [inline]
>  blocking_notifier_call_chain+0x126/0x1d0 kernel/notifier.c:388
>  __inet_del_ifa+0x87a/0x1020 net/ipv4/devinet.c:437
>  inet_del_ifa net/ipv4/devinet.c:474 [inline]
>  inetdev_destroy net/ipv4/devinet.c:327 [inline]
>  inetdev_event+0x664/0x1590 net/ipv4/devinet.c:1633
>  notifier_call_chain kernel/notifier.c:93 [inline]
>  raw_notifier_call_chain+0xe0/0x180 kernel/notifier.c:461
>  call_netdevice_notifiers_extack net/core/dev.c:2030 [inline]
>  call_netdevice_notifiers net/core/dev.c:2044 [inline]
>  unregister_netdevice_many_notify+0xd65/0x16d0 net/core/dev.c:11219
>  unregister_netdevice_many net/core/dev.c:11277 [inline]
>  unregister_netdevice_queue+0x2ff/0x370 net/core/dev.c:11156
>  unregister_netdevice include/linux/netdevice.h:3119 [inline]
>  __tun_detach+0x6ad/0x15e0 drivers/net/tun.c:685
>  tun_detach drivers/net/tun.c:701 [inline]
>  tun_chr_close+0x104/0x1b0 drivers/net/tun.c:3500
>  __fput+0x24a/0x8a0 fs/file_table.c:422
>  task_work_run+0x239/0x2f0 kernel/task_work.c:180
>  exit_task_work include/linux/task_work.h:38 [inline]
>  do_exit+0xa13/0x2560 kernel/exit.c:876
>  do_group_exit+0x1fd/0x2b0 kernel/exit.c:1025
>  get_signal+0x1697/0x1730 kernel/signal.c:2909
>  arch_do_signal_or_restart+0x92/0x7f0 arch/x86/kernel/signal.c:310
>  exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
>  exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
>  __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
>  syscall_exit_to_user_mode+0x95/0x280 kernel/entry/common.c:218
>  do_syscall_64+0x8a/0x150 arch/x86/entry/common.c:89
>  entry_SYSCALL_64_after_hwframe+0x67/0x6f
> RIP: 0033:0x7f38fcb809b9
> Code: Unable to access opcode bytes at 0x7f38fcb8098f.
> RSP: 002b:00007ffca268d598 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: 0000000000000002 RBX: 00007f38fcd45f80 RCX: 00007f38fcb809b9
> RDX: 0000000020000080 RSI: 0000000000000001 RDI: 0000000000000003
> RBP: 00007f38fcbf4f70 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007f38fcd45f80 R14: 00007f38fcd45f80 R15: 0000000000000d01
>  </TASK>
> Modules linked in:
> ---[ end trace 0000000000000000 ]---
> RIP: 0010:fib_table_lookup+0x709/0x1790 net/ipv4/fib_trie.c:1587
> Code: 38 f3 75 4c e8 38 b9 15 f8 49 be 00 00 00 00 00 fc ff df eb 05
> e8 27 b9 15 f8 48 8b 44 24 20 48 8d 58 44 48 89 d8 48 c1 e8 03 <42> 8a
> 04 30 84 c0 0f 85 76 03 00 00 0f b6 1b 31 ff 89 de e8 df bb
> RSP: 0018:ffffc90004acf020 EFLAGS: 00010203
> RAX: 0000000000000008 RBX: 0000000000000044 RCX: ffff88801db88000
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> RBP: ffffc90004acf170 R08: ffffffff897b97ee R09: 1ffffffff221f8b0
> R10: dffffc0000000000 R11: fffffbfff221f8b1 R12: 1ffff11003b1bbe6
> R13: ffff88801d8ddf20 R14: dffffc0000000000 R15: ffff88801d8ddf30
> FS:  0000000000000000(0000) GS:ffff888063a00000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f2a89116b60 CR3: 00000000202c2000 CR4: 0000000000350ef0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>
>
> --
> Yours sincerely,
> Xingyu



-- 
Yours sincerely,
Xingyu

Powered by blists - more mailing lists