netdev - Re: [PATCH v2 net] ipv6: Fix infinite recursion in fib6_dump

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89iKD8MhvSWySOUiteh=mxjt6uB6ZzRco1W-LMWWRD4K1PQ@mail.gmail.com>
Date: Tue, 2 Apr 2024 11:43:51 +0200
From: Eric Dumazet <edumazet@...gle.com>
To: Kuniyuki Iwashima <kuniyu@...zon.com>
Cc: "David S. Miller" <davem@...emloft.net>, David Ahern <dsahern@...nel.org>, 
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, 
	Kuniyuki Iwashima <kuni1840@...il.com>, netdev@...r.kernel.org, 
	syzkaller <syzkaller@...glegroups.com>
Subject: Re: [PATCH v2 net] ipv6: Fix infinite recursion in fib6_dump_done().

On Mon, Apr 1, 2024 at 11:10 PM Kuniyuki Iwashima <kuniyu@...zon.com> wrote:
>
> syzkaller reported infinite recursive calls of fib6_dump_done() during
> netlink socket destruction.  [1]
>
> From the log, syzkaller sent an AF_UNSPEC RTM_GETROUTE message, and then
> the response was generated.  The following recvmmsg() resumed the dump
> for IPv6, but the first call of inet6_dump_fib() failed at kzalloc() due
> to the fault injection.  [0]
>
>   12:01:34 executing program 3:
>   r0 = socket$nl_route(0x10, 0x3, 0x0)
>   sendmsg$nl_route(r0, ... snip ...)
>   recvmmsg(r0, ... snip ...) (fail_nth: 8)
>
> Here, fib6_dump_done() was set to nlk_sk(sk)->cb.done, and the next call
> of inet6_dump_fib() set it to nlk_sk(sk)->cb.args[3].  syzkaller stopped
> receiving the response halfway through, and finally netlink_sock_destruct()
> called nlk_sk(sk)->cb.done().

It was not clear to me why we call inet6_dump_fib() a second time
after the first call returned -ENOMEM

It seems to be caused by rtnl_dump_all(), if the skb had info from
IPv4 (skb->len != 0)

"ip -6 ro" alone is not triggering the bug.

>
> fib6_dump_done() calls fib6_dump_end() and nlk_sk(sk)->cb.done() if it
> is still not NULL.  fib6_dump_end() rewrites nlk_sk(sk)->cb.done() by
> nlk_sk(sk)->cb.args[3], but it has the same function, not NULL, calling
> itself recursively and hitting the stack guard page.
>
> To avoid the issue, let's set the destructor after kzalloc().
>
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzkaller <syzkaller@...glegroups.com>
> Signed-off-by: Kuniyuki Iwashima <kuniyu@...zon.com>

Reviewed-by: Eric Dumazet <edumazet@...gle.com>