netdev - Re: [PATCH v3 net-next 03/15] ipv6: Move some validation from ip6_route_info_create() to rtm_to_fib6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250429012052.58601-1-kuniyu@amazon.com>
Date: Mon, 28 Apr 2025 18:20:36 -0700
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <yi1.lai@...ux.intel.com>
CC: <davem@...emloft.net>, <dsahern@...nel.org>, <edumazet@...gle.com>,
	<horms@...nel.org>, <kuba@...nel.org>, <kuni1840@...il.com>,
	<kuniyu@...zon.com>, <netdev@...r.kernel.org>, <pabeni@...hat.com>,
	<syzkaller-bugs@...glegroups.com>, <yi1.lai@...el.com>
Subject: Re: [PATCH v3 net-next 03/15] ipv6: Move some validation from ip6_route_info_create() to rtm_to_fib6_config().

From: "Lai, Yi" <yi1.lai@...ux.intel.com>
Date: Tue, 29 Apr 2025 08:24:08 +0800
> Hi Kuniyuki Iwashima,
> 
> Greetings!
> 
> I used Syzkaller and found that there is KASAN: use-after-free Read in ip6_route_info_create in linux-next tag - next-20250428.
> 
> After bisection and the first bad commit is:
> "
> fa76c1674f2e ipv6: Move some validation from ip6_route_info_create() to rtm_to_fib6_config().
> "
> 
> All detailed into can be found at:
> https://github.com/laifryiee/syzkaller_logs/tree/main/250429_005622_ip6_route_info_create
> Syzkaller repro code:
> https://github.com/laifryiee/syzkaller_logs/tree/main/250429_005622_ip6_route_info_create/repro.c
> Syzkaller repro syscall steps:
> https://github.com/laifryiee/syzkaller_logs/tree/main/250429_005622_ip6_route_info_create/repro.prog
> Syzkaller report:
> https://github.com/laifryiee/syzkaller_logs/tree/main/250429_005622_ip6_route_info_create/repro.report
> Kconfig(make olddefconfig):
> https://github.com/laifryiee/syzkaller_logs/tree/main/250429_005622_ip6_route_info_create/kconfig_origin
> Bisect info:
> https://github.com/laifryiee/syzkaller_logs/tree/main/250429_005622_ip6_route_info_create/bisect_info.log
> bzImage:
> https://github.com/laifryiee/syzkaller_logs/raw/refs/heads/main/250429_005622_ip6_route_info_create/bzImage_33035b665157558254b3c21c3f049fd728e72368
> Issue dmesg:
> https://github.com/laifryiee/syzkaller_logs/blob/main/250429_005622_ip6_route_info_create/33035b665157558254b3c21c3f049fd728e72368_dmesg.log
> 
> "
> [   17.307248] ==================================================================
> [   17.307611] BUG: KASAN: slab-use-after-free in ip6_route_info_create+0xb84/0xc30
> [   17.307993] Read of size 1 at addr ffff8880100b8a94 by task repro/727
> [   17.308291] 
> [   17.308389] CPU: 0 UID: 0 PID: 727 Comm: repro Not tainted 6.15.0-rc4-next-20250428-33035b665157 #1 PREEMPT(voluntary) 
> [   17.308397] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
> [   17.308405] Call Trace:
> [   17.308412]  <TASK>
> [   17.308414]  dump_stack_lvl+0xea/0x150
> [   17.308439]  print_report+0xce/0x660
> [   17.308469]  ? ip6_route_info_create+0xb84/0xc30
> [   17.308475]  ? kasan_complete_mode_report_info+0x80/0x200
> [   17.308482]  ? ip6_route_info_create+0xb84/0xc30
> [   17.308489]  kasan_report+0xd6/0x110
> [   17.308496]  ? ip6_route_info_create+0xb84/0xc30
> [   17.308504]  __asan_report_load1_noabort+0x18/0x20
> [   17.308509]  ip6_route_info_create+0xb84/0xc30
> [   17.308516]  ip6_route_add+0x32/0x320
> [   17.308524]  ipv6_route_ioctl+0x414/0x5a0

Thanks for the report.

It seems I accidentally removed validation from the ioctl path,
not sure why I missed the path...

Will post a fix soon.