netdev - Re: [PATCH net-next v2 1/2] net: create device lookup API with reference tracking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5c3f4c48-3bd8-26c2-9b58-a7fda7d2f22c@gmail.com>
Date: Fri, 16 Jun 2023 17:10:23 -0700
From: David Ahern <dsahern@...il.com>
To: Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>
Cc: davem@...emloft.net, netdev@...r.kernel.org, pabeni@...hat.com
Subject: Re: [PATCH net-next v2 1/2] net: create device lookup API with
 reference tracking

On 6/16/23 2:21 AM, Eric Dumazet wrote:
> Oops, ip6_validate_gw() is able to change dev under us (this is done
> in ip6_route_check_nh())
> 
> Crazy, I know...

I presume you saw this with a test case or syzbot? If so, can you share?

ip6_route_check_nh sets but never resets the device:

        if (dev) {
                if (dev != res.nh->fib_nh_dev)
                        err = -EHOSTUNREACH;
        } else {
                *_dev = dev = res.nh->fib_nh_dev;
                dev_hold(dev);
                *idev = in6_dev_get(dev);
        }