netdev - Re: [PATCH net-next] ipv6: add debug checks in fib6_info

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89iKcFxJ68+M8UvHzqp1k-FDiZHZ8ujP79WJd1338DVJy6w@mail.gmail.com>
Date: Thu, 7 Dec 2023 14:29:22 +0100
From: Eric Dumazet <edumazet@...gle.com>
To: patchwork-bot+netdevbpf@...nel.org, Kui-Feng Lee <thinker.li@...il.com>
Cc: davem@...emloft.net, kuba@...nel.org, pabeni@...hat.com, 
	dsahern@...nel.org, netdev@...r.kernel.org, eric.dumazet@...il.com
Subject: Re: [PATCH net-next] ipv6: add debug checks in fib6_info_release()

On Thu, Dec 7, 2023 at 4:10 AM <patchwork-bot+netdevbpf@...nel.org> wrote:
>
> Hello:
>
> This patch was applied to netdev/net-next.git (main)
> by Jakub Kicinski <kuba@...nel.org>:
>
> On Tue,  5 Dec 2023 17:32:50 +0000 you wrote:
> > Some elusive syzbot reports are hinting to fib6_info_release(),
> > with a potential dangling f6i->gc_link anchor.
> >
> > Add debug checks so that syzbot can catch the issue earlier eventually.
> >
> > BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline]
> > BUG: KASAN: slab-use-after-free in hlist_del_init include/linux/list.h:1016 [inline]
> > BUG: KASAN: slab-use-after-free in fib6_clean_expires_locked include/net/ip6_fib.h:533 [inline]
> > BUG: KASAN: slab-use-after-free in fib6_purge_rt+0x986/0x9c0 net/ipv6/ip6_fib.c:1064
> > Write of size 8 at addr ffff88802805a840 by task syz-executor.1/10057
> >
> > [...]
>
> Here is the summary with links:
>   - [net-next] ipv6: add debug checks in fib6_info_release()
>     https://git.kernel.org/netdev/net-next/c/5a08d0065a91

Nice, syzbot gave me exactly what I was looking for.

WARNING: CPU: 0 PID: 5059 at include/net/ip6_fib.h:332
fib6_info_release include/net/ip6_fib.h:332 [inline]
WARNING: CPU: 0 PID: 5059 at include/net/ip6_fib.h:332
ip6_route_info_create+0x1a1a/0x1f10 net/ipv6/route.c:3829
Modules linked in:
CPU: 0 PID: 5059 Comm: syz-executor256 Not tainted
6.7.0-rc3-syzkaller-00805-g5a08d0065a91 #0
Hardware name: Google Google Compute Engine/Google Compute Engine,
BIOS Google 11/10/2023
RIP: 0010:fib6_info_release include/net/ip6_fib.h:332 [inline]
RIP: 0010:ip6_route_info_create+0x1a1a/0x1f10 net/ipv6/route.c:3829
Code: 49 83 7f 40 00 75 28 e8 04 ae 50 f8 49 8d bf a0 00 00 00 48 c7
c6 c0 ae 37 89 e8 41 2c 3a f8 e9 65 f4 ff ff e8 e7 ad 50 f8 90 <0f> 0b
90 eb ad e8 dc ad 50 f8 90 0f 0b 90 eb cd e8 d1 ad 50 f8 e8
RSP: 0018:ffffc90003bdf8e0 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000400000 RCX: ffffffff8936e418
RDX: ffff888026a58000 RSI: ffffffff8936e469 RDI: 0000000000000005
RBP: ffffc90003bdf9d0 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000400000 R11: ffffffff81de4c35 R12: ffffffffffffffea
R13: ffff88802993242c R14: ffffc90003bdfac4 R15: ffff888029932400
FS: 00005555562b4380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004585c0 CR3: 000000007390d000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ip6_route_add+0x26/0x1f0 net/ipv6/route.c:3843
ipv6_route_ioctl+0x3ff/0x590 net/ipv6/route.c:4467
inet6_ioctl+0x265/0x2b0 net/ipv6/af_inet6.c:575
sock_do_ioctl+0x113/0x270 net/socket.c:1220
sock_ioctl+0x22e/0x6b0 net/socket.c:1339
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl fs/ioctl.c:857 [inline]
__x64_sys_ioctl+0x18f/0x210 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f175790d369


Following commit seems buggy.

commit 3dec89b14d37ee635e772636dad3f09f78f1ab87
Author: Kui-Feng Lee <thinker.li@...il.com>
Date:   Tue Aug 15 11:07:05 2023 -0700

    net/ipv6: Remove expired routes with a separated list of routes.

    FIB6 GC walks trees of fib6_tables to remove expired routes. Walking a tree
    can be expensive if the number of routes in a table is big, even if most of
    them are permanent. Checking routes in a separated list of routes having
    expiration will avoid this potential issue.

    Signed-off-by: Kui-Feng Lee <thinker.li@...il.com>
    Reviewed-by: David Ahern <dsahern@...nel.org>
    Signed-off-by: David S. Miller <davem@...emloft.net>