netdev - Re: unregister_netdevice: waiting for DEV to become free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 31 Jul 2018 20:16:22 +0900
From:   Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To:     Steffen Klassert <steffen.klassert@...unet.com>,
        Herbert Xu <herbert@...dor.apana.org.au>,
        "David S. Miller" <davem@...emloft.net>
Cc:     syzbot <syzbot+2dfb68e639f0621b19fb@...kaller.appspotmail.com>,
        ddstreet@...e.org, dvyukov@...gle.com,
        linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
        syzkaller-bugs@...glegroups.com
Subject: Re: unregister_netdevice: waiting for DEV to become free

Steffen and Herbert,

Do you have any question? I think I provided enough information for debugging.

This problem occurs because two dev_put() calls are missing (compared with not
calling setsockopt(SOL_IPV6, IPV6_XFRM_POLICY)) because dst_release() is not
called via fib6_info_destroy_rcu() when we called xfrm_compile_policy() from
xfrm_user_policy() from setsockopt(SOL_IPV6, IPV6_XFRM_POLICY).

[   39.981210] CPU: 3 PID: 0 Comm: swapper/3 Kdump: loaded Not tainted 4.18.0-rc6+ #457
[   39.982879] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/19/2017
[   39.985689] Call Trace:
[   39.986269]  <IRQ>
[   39.986792]  dump_stack+0x99/0xdc
[   39.987601]  dst_destroy_hook+0x29/0x2b
[   39.988517]  dst_release+0x28/0x70
[   39.989481]  fib6_info_destroy_rcu+0x8e/0x100
[   39.990409]  ? fib6_walk_continue+0x1c0/0x1c0
[   39.991355]  rcu_process_callbacks+0x2cb/0x870
[   39.992376]  ? rcu_process_callbacks+0x266/0x870
[   39.993352]  __do_softirq+0xcf/0x49b
[   39.994119]  irq_exit+0xc2/0xd0
[   39.994819]  smp_apic_timer_interrupt+0xa4/0x2d0
[   39.995918]  apic_timer_interrupt+0xf/0x20
[   39.996883]  </IRQ>
 
On 2018/07/27 22:00, Tetsuo Handa wrote:
> Hello.
> 
> Since this bug is top crasher (124264 times in 98 days is almost "every minute").
> I made a simplified C reproducer based on the C reproducer provided by syzbot.
> It seems that setsockopt(SOL_IPV6, IPV6_XFRM_POLICY) is involved to this trouble.
> 
> ----------------------------------------
> #define _GNU_SOURCE
> #include <sched.h>
> #include <stdlib.h>
> #include <sys/socket.h>
> #include <netinet/in.h>
> #include <arpa/inet.h>
> 
> /*
>   ip6tnl0: flags=128<NOARP>  mtu 1452
>         unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 1000  (UNSPEC)
>         RX packets 0  bytes 0 (0.0 B)
>         RX errors 0  dropped 0  overruns 0  frame 0
>         TX packets 0  bytes 0 (0.0 B)
>         TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
> */
> #define IP_DEVNAME "ip6tnl0"
> 
> int main(int argc, char *argv[])
> {
> 	struct sockaddr_in6 addr = { };
> 	int fd;
> 	if (unshare(CLONE_NEWNET))
> 		return 1;
> 	fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_IP);
> 	if (system("ip link set dev " IP_DEVNAME " up"))
> 		return 2;
> 	setsockopt(fd, SOL_IPV6, IPV6_XFRM_POLICY, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\n\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\254\24\24\252\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0+\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\7\0\0\0\r5M&", 0xe8);
> 	addr.sin6_family = AF_INET6;
> 	inet_pton(AF_INET6, "fe80::bb", &addr.sin6_addr);
> 	addr.sin6_scope_id = 9;
> 	connect(fd, (struct sockaddr *) &addr, sizeof(addr));
> 	return 0;
> }
> ----------------------------------------
>