linux-kernel - Re: [syzbot] [net?] general protection fault in rtnl_create

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250414023048.44721-1-kuniyu@amazon.com>
Date: Sun, 13 Apr 2025 19:30:46 -0700
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <syzbot+de1c7d68a10e3f123bdd@...kaller.appspotmail.com>
CC: <cratiu@...dia.com>, <davem@...emloft.net>, <edumazet@...gle.com>,
	<horms@...nel.org>, <kuba@...nel.org>, <kuniyu@...zon.com>,
	<linux-kernel@...r.kernel.org>, <netdev@...r.kernel.org>,
	<pabeni@...hat.com>, <sdf@...ichev.me>, <syzkaller-bugs@...glegroups.com>
Subject: Re: [syzbot] [net?] general protection fault in rtnl_create_link

From: syzbot <syzbot+de1c7d68a10e3f123bdd@...kaller.appspotmail.com>
Date: Sun, 13 Apr 2025 19:14:29 -0700
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    eaa517b77e63 ethtool: cmis_cdb: Fix incorrect read / write..
> git tree:       net
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=1541f23f980000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=f2054704dd53fb80
> dashboard link: https://syzkaller.appspot.com/bug?extid=de1c7d68a10e3f123bdd
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1429874c580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1353f74c580000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/8ff6a34dbd2f/disk-eaa517b7.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/80dc0689a89b/vmlinux-eaa517b7.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/093b749f228d/bzImage-eaa517b7.xz
> 
> The issue was bisected to:
> 
> commit 04efcee6ef8d0f01eef495db047e7216d6e6e38f
> Author: Stanislav Fomichev <sdf@...ichev.me>
> Date:   Fri Apr 4 16:11:22 2025 +0000
> 
>     net: hold instance lock during NETDEV_CHANGE
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=151db7e4580000
> final oops:     https://syzkaller.appspot.com/x/report.txt?x=171db7e4580000
> console output: https://syzkaller.appspot.com/x/log.txt?x=131db7e4580000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+de1c7d68a10e3f123bdd@...kaller.appspotmail.com
> Fixes: 04efcee6ef8d ("net: hold instance lock during NETDEV_CHANGE")
> 
> netlink: 4 bytes leftover after parsing attributes in process `syz-executor402'.
> netlink: 'syz-executor402': attribute type 15 has an invalid length.
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000055: 0000 [#1] SMP KASAN PTI
> KASAN: null-ptr-deref in range [0x00000000000002a8-0x00000000000002af]
> CPU: 0 UID: 0 PID: 5841 Comm: syz-executor402 Not tainted 6.14.0-syzkaller-13348-geaa517b77e63 #0 PREEMPT(full) 
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
> RIP: 0010:netdev_need_ops_lock include/net/netdev_lock.h:33 [inline]
> RIP: 0010:netdev_lock_ops include/net/netdev_lock.h:41 [inline]
> RIP: 0010:rtnl_create_link+0x6af/0xea0 net/core/rtnetlink.c:3680

#syz test

diff --git a/include/net/netdev_lock.h b/include/net/netdev_lock.h
index 5706835a660c..270e157a4a79 100644
--- a/include/net/netdev_lock.h
+++ b/include/net/netdev_lock.h
@@ -30,7 +30,8 @@ static inline bool netdev_need_ops_lock(const struct net_device *dev)
 	bool ret = dev->request_ops_lock || !!dev->queue_mgmt_ops;
 
 #if IS_ENABLED(CONFIG_NET_SHAPER)
-	ret |= !!dev->netdev_ops->net_shaper_ops;
+	if (dev->netdev_ops)
+		ret |= !!dev->netdev_ops->net_shaper_ops;
 #endif
 
 	return ret;