netdev - Re: [Bug 199637] New: UBSAN: Undefined behaviour in net/ipv4/fib

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3972f02f-3dc4-c3ca-5354-d7a839f50782@gmail.com>
Date:   Thu, 7 Jun 2018 18:27:01 -0700
From:   David Ahern <dsahern@...il.com>
To:     Jakub Kicinski <jakub.kicinski@...ronome.com>,
        Stephen Hemminger <stephen@...workplumber.org>
Cc:     netdev@...r.kernel.org, David Miller <davem@...emloft.net>
Subject: Re: [Bug 199637] New: UBSAN: Undefined behaviour in
 net/ipv4/fib_trie.c:503:6

On 6/7/18 5:07 PM, Jakub Kicinski wrote:

>> After recompiling the 4.16.7 kernel with gcc 8.1, UBSAN reports the following:
>>
>> [   25.427424]
>> ================================================================================
>> [   25.429680] UBSAN: Undefined behaviour in net/ipv4/fib_trie.c:503:6
>> [   25.431920] member access within null pointer of type 'struct tnode'
>> [   25.434153] CPU: 3 PID: 1 Comm: systemd Not tainted 4.16.7-CUSTOM #1
>> [   25.436384] Hardware name: Gigabyte Technology Co., Ltd.
>> H67MA-UD2H-B3/H67MA-UD2H-B3, BIOS F8 03/27/2012
>> [   25.438647] Call Trace:
>> [   25.440889]  dump_stack+0x62/0x9f
>> [   25.443104]  ubsan_epilogue+0x9/0x35
>> [   25.445293]  handle_null_ptr_deref+0x80/0x90
>> [   25.447464]  __ubsan_handle_type_mismatch_v1+0x6a/0x80
>> [   25.449628]  tnode_free+0xce/0x120

arguably this one should be guarded:

diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 5bc0c89e81e4..32c589059fb3 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -501,7 +501,8 @@ static void tnode_free(struct key_vector *tn)
                tnode_free_size += TNODE_SIZE(1ul << tn->bits);
                node_free(tn);

-               tn = container_of(head, struct tnode, rcu)->kv;
+               if (head)
+                       tn = container_of(head, struct tnode, rcu)->kv;
        }

        if (tnode_free_size >= PAGE_SIZE * sync_pages) {


but if head is NULL, tn is set but not dereferenced as the loop breaks.