netdev - Re: [PATCH net] ipmr: properly check rhltable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 21 May 2018 21:24:12 +0300
From:   Nikolay Aleksandrov <nikolay@...ulusnetworks.com>
To:     Eric Dumazet <edumazet@...gle.com>,
        "David S . Miller" <davem@...emloft.net>
Cc:     netdev <netdev@...r.kernel.org>,
        Eric Dumazet <eric.dumazet@...il.com>,
        Yuval Mintz <yuvalm@...lanox.com>
Subject: Re: [PATCH net] ipmr: properly check rhltable_init() return value

On 05/21/2018 08:51 PM, Eric Dumazet wrote:
> commit 8fb472c09b9d ("ipmr: improve hash scalability")
> added a call to rhltable_init() without checking its return value.
> 
> This problem was then later copied to IPv6 and factorized in commit
> 0bbbf0e7d0e7 ("ipmr, ip6mr: Unite creation of new mr_table")
> 
> kasan: CONFIG_KASAN_INLINE enabled
> kasan: GPF could be caused by NULL-ptr deref or user memory access
> general protection fault: 0000 [#1] SMP KASAN
> Dumping ftrace buffer:
>    (ftrace buffer empty)
> Modules linked in:
> CPU: 1 PID: 31552 Comm: syz-executor7 Not tainted 4.17.0-rc5+ #60
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> RIP: 0010:rht_key_hashfn include/linux/rhashtable.h:277 [inline]
> RIP: 0010:__rhashtable_lookup include/linux/rhashtable.h:630 [inline]
> RIP: 0010:rhltable_lookup include/linux/rhashtable.h:716 [inline]
> RIP: 0010:mr_mfc_find_parent+0x2ad/0xbb0 net/ipv4/ipmr_base.c:63
> RSP: 0018:ffff8801826aef70 EFLAGS: 00010203
> RAX: 0000000000000001 RBX: 0000000000000001 RCX: ffffc90001ea0000
> RDX: 0000000000000079 RSI: ffffffff8661e859 RDI: 000000000000000c
> RBP: ffff8801826af1c0 R08: ffff8801b2212000 R09: ffffed003b5e46c2
> R10: ffffed003b5e46c2 R11: ffff8801daf23613 R12: dffffc0000000000
> R13: ffff8801826af198 R14: ffff8801cf8225c0 R15: ffff8801826af658
> FS:  00007ff7fa732700(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00000003ffffff9c CR3: 00000001b0210000 CR4: 00000000001406e0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
>  ip6mr_cache_find_parent net/ipv6/ip6mr.c:981 [inline]
>  ip6mr_mfc_delete+0x1fe/0x6b0 net/ipv6/ip6mr.c:1221
>  ip6_mroute_setsockopt+0x15c6/0x1d70 net/ipv6/ip6mr.c:1698
>  do_ipv6_setsockopt.isra.9+0x422/0x4660 net/ipv6/ipv6_sockglue.c:163
>  ipv6_setsockopt+0xbd/0x170 net/ipv6/ipv6_sockglue.c:922
>  rawv6_setsockopt+0x59/0x140 net/ipv6/raw.c:1060
>  sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3039
>  __sys_setsockopt+0x1bd/0x390 net/socket.c:1903
>  __do_sys_setsockopt net/socket.c:1914 [inline]
>  __se_sys_setsockopt net/socket.c:1911 [inline]
>  __x64_sys_setsockopt+0xbe/0x150 net/socket.c:1911
>  do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
>  entry_SYSCALL_64_after_hwframe+0x49/0xbe
> 
> Fixes: 8fb472c09b9d ("ipmr: improve hash scalability")
> Fixes: 0bbbf0e7d0e7 ("ipmr, ip6mr: Unite creation of new mr_table")
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Cc: Nikolay Aleksandrov <nikolay@...ulusnetworks.com>
> Cc: Yuval Mintz <yuvalm@...lanox.com>
> Reported-by: syzbot <syzkaller@...glegroups.com>
> ---
>  net/ipv4/ipmr_base.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 

Oops :). Thanks!

Acked-by: Nikolay Aleksandrov <nikolay@...ulusnetworks.com>