linux-kernel - Re: [syzbot] [net?] BUG: corrupted list in flow_block_cb_setup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250912093042.6843-1-hdanton@sina.com>
Date: Fri, 12 Sep 2025 17:30:40 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+5a66db916cdde0dbcc1c@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [net?] BUG: corrupted list in flow_block_cb_setup_simple

> Date: Fri, 12 Sep 2025 00:06:29 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    e59a039119c3 Merge tag 's390-6.17-4' of git://git.kernel.o..
> git tree:       bpf
> console output: https://syzkaller.appspot.com/x/log.txt?x=1523e934580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=4d8792ecb6308d0f
> dashboard link: https://syzkaller.appspot.com/bug?extid=5a66db916cdde0dbcc1c
> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16d4bd62580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10d69642580000

#syz test upstream master

--- x/net/core/flow_offload.c
+++ y/net/core/flow_offload.c
@@ -334,6 +334,7 @@ bool flow_block_cb_is_busy(flow_setup_cb
 }
 EXPORT_SYMBOL(flow_block_cb_is_busy);
 
+static DEFINE_MUTEX(setup_lock);
 int flow_block_cb_setup_simple(struct flow_block_offload *f,
 			       struct list_head *driver_block_list,
 			       flow_setup_cb_t *cb,
@@ -348,27 +349,37 @@ int flow_block_cb_setup_simple(struct fl
 
 	f->driver_block_list = driver_block_list;
 
+	mutex_lock(&setup_lock);
 	switch (f->command) {
 	case FLOW_BLOCK_BIND:
-		if (flow_block_cb_is_busy(cb, cb_ident, driver_block_list))
+		if (flow_block_cb_is_busy(cb, cb_ident, driver_block_list)) {
+			mutex_unlock(&setup_lock);
 			return -EBUSY;
+		}
 
 		block_cb = flow_block_cb_alloc(cb, cb_ident, cb_priv, NULL);
-		if (IS_ERR(block_cb))
+		if (IS_ERR(block_cb)) {
+			mutex_unlock(&setup_lock);
 			return PTR_ERR(block_cb);
+		}
 
 		flow_block_cb_add(block_cb, f);
 		list_add_tail(&block_cb->driver_list, driver_block_list);
+		mutex_unlock(&setup_lock);
 		return 0;
 	case FLOW_BLOCK_UNBIND:
 		block_cb = flow_block_cb_lookup(f->block, cb, cb_ident);
-		if (!block_cb)
+		if (!block_cb) {
+			mutex_unlock(&setup_lock);
 			return -ENOENT;
+		}
 
 		flow_block_cb_remove(block_cb, f);
 		list_del(&block_cb->driver_list);
+		mutex_unlock(&setup_lock);
 		return 0;
 	default:
+		mutex_unlock(&setup_lock);
 		return -EOPNOTSUPP;
 	}
 }
--