linux-kernel - Re: [PATCH net] ipv6: Fix ECMP sibling count mismatch when clearing RTF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e7d8487b-32aa-4895-91e2-a594a26e4efd@suse.de>
Date: Wed, 4 Feb 2026 13:59:07 +0100
From: Fernando Fernandez Mancera <fmancera@...e.de>
To: Shigeru Yoshida <syoshida@...hat.com>, davem@...emloft.net,
 dsahern@...nel.org, edumazet@...gle.com, kuba@...nel.org, pabeni@...hat.com,
 horms@...nel.org
Cc: netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
 syzbot+cb809def1baaac68ab92@...kaller.appspotmail.com
Subject: Re: [PATCH net] ipv6: Fix ECMP sibling count mismatch when clearing
 RTF_ADDRCONF

On 2/4/26 10:58 AM, Shigeru Yoshida wrote:
> syzbot reported a kernel BUG in fib6_add_rt2node() when adding an IPv6
> route. [0]
> 
> Commit f72514b3c569 ("ipv6: clear RA flags when adding a static
> route") introduced logic to clear RTF_ADDRCONF from existing routes
> when a static route with the same nexthop is added. However, this
> causes a problem when the existing route has a gateway.
> 
> When RTF_ADDRCONF is cleared from a route that has a gateway, that
> route becomes eligible for ECMP, i.e. rt6_qualify_for_ecmp() returns
> true. The issue is that this route was never added to the
> fib6_siblings list.
> 
> This leads to a mismatch between the following counts:
> 
> - The sibling count computed by iterating fib6_next chain, which
>    includes the newly ECMP-eligible route
> 
> - The actual siblings in fib6_siblings list, which does not include
>    that route
> 
> When a subsequent ECMP route is added, fib6_add_rt2node() hits
> BUG_ON(sibling->fib6_nsiblings != rt->fib6_nsiblings) because the
> counts don't match.
> 
> Fix this by only clearing RTF_ADDRCONF when the existing route does
> not have a gateway. Routes without a gateway cannot qualify for ECMP
> anyway (rt6_qualify_for_ecmp() requires fib_nh_gw_family), so clearing
> RTF_ADDRCONF on them is safe and matches the original intent of the
> commit.
> 
> [0]:
> kernel BUG at net/ipv6/ip6_fib.c:1217!
> Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
> CPU: 0 UID: 0 PID: 6010 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
> RIP: 0010:fib6_add_rt2node+0x3433/0x3470 net/ipv6/ip6_fib.c:1217
> [...]
> Call Trace:
>   <TASK>
>   fib6_add+0x8da/0x18a0 net/ipv6/ip6_fib.c:1532
>   __ip6_ins_rt net/ipv6/route.c:1351 [inline]
>   ip6_route_add+0xde/0x1b0 net/ipv6/route.c:3946
>   ipv6_route_ioctl+0x35c/0x480 net/ipv6/route.c:4571
>   inet6_ioctl+0x219/0x280 net/ipv6/af_inet6.c:577
>   sock_do_ioctl+0xdc/0x300 net/socket.c:1245
>   sock_ioctl+0x576/0x790 net/socket.c:1366
>   vfs_ioctl fs/ioctl.c:51 [inline]
>   __do_sys_ioctl fs/ioctl.c:597 [inline]
>   __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
>   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>   do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
>   entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> Fixes: f72514b3c569 ("ipv6: clear RA flags when adding a static route")
> Reported-by: syzbot+cb809def1baaac68ab92@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=cb809def1baaac68ab92
> Tested-by: syzbot+cb809def1baaac68ab92@...kaller.appspotmail.com
> Signed-off-by: Shigeru Yoshida <syoshida@...hat.com>
> ---
>   net/ipv6/ip6_fib.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)

Thanks for catching this. I got a bash reproducer and will send a 
kselftest for this specific scenario.

Reviewed-by: Fernando Fernandez Mancera <fmancera@...e.de>