netdev - Re: [PATCH net-next] inet: fix lwtunnel_valid_encap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250304184408.9444-1-kuniyu@amazon.com>
Date: Tue, 4 Mar 2025 10:44:05 -0800
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <edumazet@...gle.com>
CC: <davem@...emloft.net>, <dsahern@...nel.org>, <eric.dumazet@...il.com>,
	<horms@...nel.org>, <kuba@...nel.org>, <kuniyu@...zon.com>,
	<netdev@...r.kernel.org>, <pabeni@...hat.com>,
	<syzbot+3f18ef0f7df107a3f6a0@...kaller.appspotmail.com>
Subject: Re: [PATCH net-next] inet: fix lwtunnel_valid_encap_type() lock imbalance

From: Eric Dumazet <edumazet@...gle.com>
Date: Tue,  4 Mar 2025 12:59:18 +0000
> After blamed commit rtm_to_fib_config() now calls
> lwtunnel_valid_encap_type{_attr}() without RTNL held,
> triggering an unlock balance in __rtnl_unlock,
> as reported by syzbot [1]
> 
> IPv6 and rtm_to_nh_config() are not yet converted.
> 
> Add a temporary @rtnl_is_held parameter to lwtunnel_valid_encap_type()
> and lwtunnel_valid_encap_type_attr().
> 
> While we are at it replace the two rcu_dereference()
> in lwtunnel_valid_encap_type() with more appropriate
> rcu_access_pointer().
> 
> [1]
> syz-executor245/5836 is trying to release lock (rtnl_mutex) at:
>  [<ffffffff89d0e38c>] __rtnl_unlock+0x6c/0xf0 net/core/rtnetlink.c:142
> but there are no more locks to release!
> 
> other info that might help us debug this:
> no locks held by syz-executor245/5836.
> 
> stack backtrace:
> CPU: 0 UID: 0 PID: 5836 Comm: syz-executor245 Not tainted 6.14.0-rc4-syzkaller-00873-g3424291dd242 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
> Call Trace:
>  <TASK>
>   __dump_stack lib/dump_stack.c:94 [inline]
>   dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
>   print_unlock_imbalance_bug+0x25b/0x2d0 kernel/locking/lockdep.c:5289
>   __lock_release kernel/locking/lockdep.c:5518 [inline]
>   lock_release+0x47e/0xa30 kernel/locking/lockdep.c:5872
>   __mutex_unlock_slowpath+0xec/0x800 kernel/locking/mutex.c:891
>   __rtnl_unlock+0x6c/0xf0 net/core/rtnetlink.c:142
>   lwtunnel_valid_encap_type+0x38a/0x5f0 net/core/lwtunnel.c:169
>   lwtunnel_valid_encap_type_attr+0x113/0x270 net/core/lwtunnel.c:209
>   rtm_to_fib_config+0x949/0x14e0 net/ipv4/fib_frontend.c:808
>   inet_rtm_newroute+0xf6/0x2a0 net/ipv4/fib_frontend.c:917
>   rtnetlink_rcv_msg+0x791/0xcf0 net/core/rtnetlink.c:6919
>   netlink_rcv_skb+0x206/0x480 net/netlink/af_netlink.c:2534
>   netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
>   netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1339
>   netlink_sendmsg+0x8de/0xcb0 net/netlink/af_netlink.c:1883
>   sock_sendmsg_nosec net/socket.c:709 [inline]
> 
> Fixes: 1dd2af7963e9 ("ipv4: fib: Convert RTM_NEWROUTE and RTM_DELROUTE to per-netns RTNL.")
> Reported-by: syzbot+3f18ef0f7df107a3f6a0@...kaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/67c6f87a.050a0220.38b91b.0147.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>

Reviewed-by: Kuniyuki Iwashima <kuniyu@...zon.com>

I completely missed this, thank you!
I'll post v6 and nexthop series after this is merged.