netdev - [PATCH] ipv6: delay procfs initialization after the ipv6 structs are ready

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240320171858.2671-1-nicolas.cavallari@green-communications.fr>
Date: Wed, 20 Mar 2024 18:17:36 +0100
From: Nicolas Cavallari <nicolas.cavallari@...en-communications.fr>
To: "David S. Miller" <davem@...emloft.net>,
	David Ahern <dsahern@...nel.org>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>,
	Paolo Abeni <pabeni@...hat.com>
Cc: netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH] ipv6: delay procfs initialization after the ipv6 structs are ready

procfs files are created before the structure they reference are
initialized.  For example, if6_proc_init() creates procfs files that
access structures initialized by addrconf_init().

If ipv6 is compiled as a module and a program manages to open an ipv6
procfs file during the loading of the module, it can oops the kernel.

It appears that we were unlucky enough to reproduce this problem
multiple times already, out of maybe 100 boots:

NET: Registered PF_INET6 protocol family
8<--- cut here ---
pwm-backlight backlight: supply power not found, using dummy regulator
Segment Routing with IPv6
In-situ OAM (IOAM) with IPv6
Unable to handle kernel NULL pointer dereference at virtual address
 00000000
mt7915e 0000:03:00.0 wlp3s0: renamed from wlan0
[00000000] *pgd=00000000
Internal error: Oops: 5 [#1] SMP ARM
Modules linked in: ipv6 mt7915e mt76_connac_lib mt76 dw_hdmi_imx
 mac80211 dw_hdmi drm_display_helper imxdrm drm_dma_helper
 drm_kms_helper snd_soc_imx_sgtl5000 syscopyarea sysfillrect sysimgblt
 fb_sys_fops imx_ipu_v3 snd_soc_fsl_asoc_card cfg80211 snd_soc_sgtl5000
 drm libarc4 snd_soc_fsl_ssi snd_soc_simple_card_utils imx_pcm_dma
 snd_soc_core rfkill snd_pcm_dmaengine snd_pcm
 drm_panel_orientation_quirks cfbfillrect cfbimgblt cfbcopyarea
 snd_timer snd egalax_ts snd_soc_imx_audmux soundcore flexcan mux_mmio
 imx2_wdt mux_core can_dev pwm_bl
CPU: 2 PID: 850 Comm: snmpd Not tainted 6.1.14 #1
Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
PC is at if6_seq_start+0x2c/0x98 [ipv6]
LR is at init_net+0x0/0xc00
[...]
 if6_seq_start [ipv6] from seq_read_iter+0xb4/0x510
 seq_read_iter from seq_read+0x80/0xac
 seq_read from proc_reg_read+0xac/0x100
 proc_reg_read from vfs_read+0xb0/0x284
 vfs_read from ksys_read+0x64/0xec
 ksys_read from ret_fast_syscall+0x0/0x54
Exception stack(0xf0e31fa8 to 0xf0e31ff0)
1fa0:                   b67fd0b0 be8a666b 0000000a b67fd148 00000400
 00000000
1fc0: b67fd0b0 be8a666b 00000001 00000003 be8a67ec 00000000 b6d7e000
 b6c9954a
1fe0: b6d7eb30 be8a6638 b6ef11b4 b6ef0ddc
Code: e5931004 e35100ff ca000014 e59e25dc (e7920101)
---[ end trace 0000000000000000 ]---

Signed-off-by: Nicolas Cavallari <nicolas.cavallari@...en-communications.fr>
---
 net/ipv6/af_inet6.c | 45 +++++++++++++++++++++++----------------------
 1 file changed, 23 insertions(+), 22 deletions(-)

diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 8041dc181bd4..d12d690a4867 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -1148,18 +1148,6 @@ static int __init inet6_init(void)
 	err = ipv6_netfilter_init();
 	if (err)
 		goto netfilter_fail;
-	/* Create /proc/foo6 entries. */
-#ifdef CONFIG_PROC_FS
-	err = -ENOMEM;
-	if (raw6_proc_init())
-		goto proc_raw6_fail;
-	if (udplite6_proc_init())
-		goto proc_udplite6_fail;
-	if (ipv6_misc_proc_init())
-		goto proc_misc6_fail;
-	if (if6_proc_init())
-		goto proc_if6_fail;
-#endif
 	err = ip6_route_init();
 	if (err)
 		goto ip6_route_fail;
@@ -1226,6 +1214,19 @@ static int __init inet6_init(void)
 	if (err)
 		goto ioam6_fail;
 
+	/* Create /proc/foo6 entries only after ipv6 structs are ready. */
+#ifdef CONFIG_PROC_FS
+	err = -ENOMEM;
+	if (raw6_proc_init())
+		goto proc_raw6_fail;
+	if (udplite6_proc_init())
+		goto proc_udplite6_fail;
+	if (ipv6_misc_proc_init())
+		goto proc_misc6_fail;
+	if (if6_proc_init())
+		goto proc_if6_fail;
+#endif
+
 	err = igmp6_late_init();
 	if (err)
 		goto igmp6_late_err;
@@ -1248,6 +1249,16 @@ static int __init inet6_init(void)
 	igmp6_late_cleanup();
 #endif
 igmp6_late_err:
+#ifdef CONFIG_PROC_FS
+	if6_proc_exit();
+proc_if6_fail:
+	ipv6_misc_proc_exit();
+proc_misc6_fail:
+	udplite6_proc_exit();
+proc_udplite6_fail:
+	raw6_proc_exit();
+proc_raw6_fail:
+#endif
 	ioam6_exit();
 ioam6_fail:
 	rpl_exit();
@@ -1282,16 +1293,6 @@ static int __init inet6_init(void)
 ndisc_late_fail:
 	ip6_route_cleanup();
 ip6_route_fail:
-#ifdef CONFIG_PROC_FS
-	if6_proc_exit();
-proc_if6_fail:
-	ipv6_misc_proc_exit();
-proc_misc6_fail:
-	udplite6_proc_exit();
-proc_udplite6_fail:
-	raw6_proc_exit();
-proc_raw6_fail:
-#endif
 	ipv6_netfilter_fini();
 netfilter_fail:
 	igmp6_cleanup();
-- 
2.43.0