netdev - Re: [PATCH] ipv6: delay procfs initialization after the ipv6 structs are ready

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240320221813.11611-1-kuniyu@amazon.com>
Date: Wed, 20 Mar 2024 15:18:13 -0700
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <nicolas.cavallari@...en-communications.fr>
CC: <davem@...emloft.net>, <dsahern@...nel.org>, <edumazet@...gle.com>,
	<kuba@...nel.org>, <linux-kernel@...r.kernel.org>, <netdev@...r.kernel.org>,
	<pabeni@...hat.com>, Kuniyuki Iwashima <kuniyu@...zon.com>
Subject: Re: [PATCH] ipv6: delay procfs initialization after the ipv6 structs are ready

From: Nicolas Cavallari <nicolas.cavallari@...en-communications.fr>
Date: Wed, 20 Mar 2024 18:17:36 +0100
> procfs files are created before the structure they reference are
> initialized.  For example, if6_proc_init() creates procfs files that
> access structures initialized by addrconf_init().
> 
> If ipv6 is compiled as a module and a program manages to open an ipv6
> procfs file during the loading of the module, it can oops the kernel.
> 
> It appears that we were unlucky enough to reproduce this problem
> multiple times already, out of maybe 100 boots:
> 
> NET: Registered PF_INET6 protocol family
> 8<--- cut here ---
> pwm-backlight backlight: supply power not found, using dummy regulator
> Segment Routing with IPv6
> In-situ OAM (IOAM) with IPv6
> Unable to handle kernel NULL pointer dereference at virtual address
>  00000000
> mt7915e 0000:03:00.0 wlp3s0: renamed from wlan0
> [00000000] *pgd=00000000
> Internal error: Oops: 5 [#1] SMP ARM
> Modules linked in: ipv6 mt7915e mt76_connac_lib mt76 dw_hdmi_imx
>  mac80211 dw_hdmi drm_display_helper imxdrm drm_dma_helper
>  drm_kms_helper snd_soc_imx_sgtl5000 syscopyarea sysfillrect sysimgblt
>  fb_sys_fops imx_ipu_v3 snd_soc_fsl_asoc_card cfg80211 snd_soc_sgtl5000
>  drm libarc4 snd_soc_fsl_ssi snd_soc_simple_card_utils imx_pcm_dma
>  snd_soc_core rfkill snd_pcm_dmaengine snd_pcm
>  drm_panel_orientation_quirks cfbfillrect cfbimgblt cfbcopyarea
>  snd_timer snd egalax_ts snd_soc_imx_audmux soundcore flexcan mux_mmio
>  imx2_wdt mux_core can_dev pwm_bl
> CPU: 2 PID: 850 Comm: snmpd Not tainted 6.1.14 #1
> Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
> PC is at if6_seq_start+0x2c/0x98 [ipv6]
> LR is at init_net+0x0/0xc00
> [...]
>  if6_seq_start [ipv6] from seq_read_iter+0xb4/0x510
>  seq_read_iter from seq_read+0x80/0xac
>  seq_read from proc_reg_read+0xac/0x100
>  proc_reg_read from vfs_read+0xb0/0x284
>  vfs_read from ksys_read+0x64/0xec
>  ksys_read from ret_fast_syscall+0x0/0x54
> Exception stack(0xf0e31fa8 to 0xf0e31ff0)
> 1fa0:                   b67fd0b0 be8a666b 0000000a b67fd148 00000400
>  00000000
> 1fc0: b67fd0b0 be8a666b 00000001 00000003 be8a67ec 00000000 b6d7e000
>  b6c9954a
> 1fe0: b6d7eb30 be8a6638 b6ef11b4 b6ef0ddc
> Code: e5931004 e35100ff ca000014 e59e25dc (e7920101)
> ---[ end trace 0000000000000000 ]---
> 
> Signed-off-by: Nicolas Cavallari <nicolas.cavallari@...en-communications.fr>

Reviewed-by: Kuniyuki Iwashima <kuniyu@...zon.com>