netdev - Re: [PATCH v2 net] ipv6: Fix infinite recursion in fib6_dump

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6f2bb8b9-a1a6-40ab-acd2-5767ec2c888d@kernel.org>
Date: Tue, 2 Apr 2024 08:46:51 -0600
From: David Ahern <dsahern@...nel.org>
To: Kuniyuki Iwashima <kuniyu@...zon.com>,
 "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
 Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>
Cc: Kuniyuki Iwashima <kuni1840@...il.com>, netdev@...r.kernel.org,
 syzkaller <syzkaller@...glegroups.com>
Subject: Re: [PATCH v2 net] ipv6: Fix infinite recursion in fib6_dump_done().

On 4/1/24 3:10 PM, Kuniyuki Iwashima wrote:
> syzkaller reported infinite recursive calls of fib6_dump_done() during
> netlink socket destruction.  [1]
> 
> From the log, syzkaller sent an AF_UNSPEC RTM_GETROUTE message, and then
> the response was generated.  The following recvmmsg() resumed the dump
> for IPv6, but the first call of inet6_dump_fib() failed at kzalloc() due
> to the fault injection.  [0]
> 
>   12:01:34 executing program 3:
>   r0 = socket$nl_route(0x10, 0x3, 0x0)
>   sendmsg$nl_route(r0, ... snip ...)
>   recvmmsg(r0, ... snip ...) (fail_nth: 8)
> 
> Here, fib6_dump_done() was set to nlk_sk(sk)->cb.done, and the next call
> of inet6_dump_fib() set it to nlk_sk(sk)->cb.args[3].  syzkaller stopped
> receiving the response halfway through, and finally netlink_sock_destruct()
> called nlk_sk(sk)->cb.done().
> 
> fib6_dump_done() calls fib6_dump_end() and nlk_sk(sk)->cb.done() if it
> is still not NULL.  fib6_dump_end() rewrites nlk_sk(sk)->cb.done() by
> nlk_sk(sk)->cb.args[3], but it has the same function, not NULL, calling
> itself recursively and hitting the stack guard page.
> 
> To avoid the issue, let's set the destructor after kzalloc().
> 

...

> Modules linked in:
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzkaller <syzkaller@...glegroups.com>
> Signed-off-by: Kuniyuki Iwashima <kuniyu@...zon.com>
> ---
> Conflict with:
> https://lore.kernel.org/netdev/20240329183053.644630-1-edumazet@google.com/
> 
> Changes:
>   v2: Removed the garbage in the head of description
>   v1: https://lore.kernel.org/netdev/20240401205020.22723-1-kuniyu@amazon.com/
> ---
>  net/ipv6/ip6_fib.c | 14 +++++++-------
>  1 file changed, 7 insertions(+), 7 deletions(-)
> 

Reviewed-by: David Ahern <dsahern@...nel.org>