netdev - [BUG] WARNING in ipmr_rules

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJNGr6tmGa7_tq8+zDqQx1=8u6G+VtHPqSg1mRYqTDqT986buQ@mail.gmail.com>
Date: Thu, 15 May 2025 19:37:35 +0800
From: Guoyu Yin <y04609127@...il.com>
To: davem@...emloft.net
Cc: dsahern@...nel.org, edumazet@...gle.com, kuba@...nel.org, 
	pabeni@...hat.com, horms@...nel.org, netdev@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: [BUG] WARNING in ipmr_rules_exit

Hi,

I discovered a kernel crash using the Syzkaller framework, described
as "WARNING in ipmr_rules_exit." This issue occurs in the
ipmr_free_table function at net/ipv4/ipmr.c:440, specifically when
ipmr_rules_exit calls ipmr_free_table, triggering the
WARN_ON_ONCE(!ipmr_can_free_table(net)); warning.

>From the call stack, this warning is triggered during the exit of a
network namespace, specifically in ipmr_net_exit_batch when calling
ipmr_rules_exit. The warning indicates that ipmr_can_free_table
returned false, suggesting that the mrt table may still have active
data structures when attempting to free it.

Possible causes include:

1. Incomplete cleanup: The mroute_clean_tables function may not have
fully cleaned up all data structures in the mrt table.

2. Race conditions: Concurrent access or modification of the mrt table
by other threads or processes during cleanup.

3. Reference count errors: Some data structures in the mrt table may
not have their reference counts properly decremented to zero.

Suggested fixes:

1. Add proper reference counting for mr_table to prevent premature freeing

2. Enhance ipmr_can_free_table() checks to verify complete entry cleanup

3. Implement synchronization between multicast route deletion and
namespace teardown

This can be reproduced on:

HEAD commit:

38fec10eb60d687e30c8c6b5420d86e8149f7557

report: https://pastebin.com/raw/seSjBgav

console output : https://pastebin.com/eD6Kbw39

kernel config : https://pastebin.com/raw/u0Efyj5P

C reproducer : https://pastebin.com/raw/EanQb7cs