netdev - Re: [syzbot] WARNING in __dev_change_net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 11 Nov 2021 08:50:33 +0100
From:   Johannes Berg <johannes@...solutions.net>
To:     syzbot <syzbot+5434727aa485c3203fed@...kaller.appspotmail.com>,
        "andrii@...nel.org" <andrii@...nel.org>,
        "ast@...nel.org" <ast@...nel.org>,
        "avagin@...il.com" <avagin@...il.com>,
        "bpf@...r.kernel.org" <bpf@...r.kernel.org>,
        "cong.wang@...edance.com" <cong.wang@...edance.com>,
        "daniel@...earbox.net" <daniel@...earbox.net>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "hawk@...nel.org" <hawk@...nel.org>,
        "john.fastabend@...il.com" <john.fastabend@...il.com>,
        "kafai@...com" <kafai@...com>,
        "kpsingh@...nel.org" <kpsingh@...nel.org>,
        "kuba@...nel.org" <kuba@...nel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "songliubraving@...com" <songliubraving@...com>,
        "syzkaller-bugs@...glegroups.com" <syzkaller-bugs@...glegroups.com>,
        "yhs@...com" <yhs@...com>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: Re: [syzbot] WARNING in __dev_change_net_namespace

On Thu, 2021-11-11 at 06:43 +0000, syzbot wrote:
> 
> console output: https://syzkaller.appspot.com/x/log.txt?x=15b45fb6b00000

So we see that fault injection is triggering a memory allocation failure
deep within the device_rename():

int __dev_change_net_namespace(struct net_device *dev, struct net *net,
                               const char *pat, int new_ifindex)
{
...
        /* Fixup kobjects */
        err = device_rename(&dev->dev, dev->name);
        WARN_ON(err);


So we hit that WARN_ON().

I'm not really sure what to do about that though. Feels like we should
be able to cope with failures here, but clearly we don't, and it seems
like it would also be tricky to do after all the work already done at
this point.

Perhaps device_rename() could grow an API to preallocate all the
memories, but that would also be fairly involved, I imagine?

johannes