e873e4b9cc
In the code path where only rcu read lock is held, e.g. in the route
lookup code path, it is not safe to directly call fib6_info_hold()
because the fib6_info may already have been deleted but still exists
in the rcu grace period. Holding reference to it could cause double
free and crash the kernel.
This patch adds a new function fib6_info_hold_safe() and replace
fib6_info_hold() in all necessary places.
Syzbot reported 3 crash traces because of this. One of them is:
8021q: adding VLAN 0 to HW filter on device team0
IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
dst_release: dst:(____ptrval____) refcnt:-1
dst_release: dst:(____ptrval____) refcnt:-2
WARNING: CPU: 1 PID: 4845 at include/net/dst.h:239 dst_hold include/net/dst.h:239 [inline]
WARNING: CPU: 1 PID: 4845 at include/net/dst.h:239 ip6_setup_cork+0xd66/0x1830 net/ipv6/ip6_output.c:1204
dst_release: dst:(____ptrval____) refcnt:-1
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 4845 Comm: syz-executor493 Not tainted 4.18.0-rc3+ #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
panic+0x238/0x4e7 kernel/panic.c:184
dst_release: dst:(____ptrval____) refcnt:-2
dst_release: dst:(____ptrval____) refcnt:-3
__warn.cold.8+0x163/0x1ba kernel/panic.c:536
dst_release: dst:(____ptrval____) refcnt:-4
report_bug+0x252/0x2d0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:178 [inline]
do_error_trap+0x1fc/0x4d0 arch/x86/kernel/traps.c:296
dst_release: dst:(____ptrval____) refcnt:-5
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:992
RIP: 0010:dst_hold include/net/dst.h:239 [inline]
RIP: 0010:ip6_setup_cork+0xd66/0x1830 net/ipv6/ip6_output.c:1204
Code: c1 ed 03 89 9d 18 ff ff ff 48 b8 00 00 00 00 00 fc ff df 41 c6 44 05 00 f8 e9 2d 01 00 00 4c 8b a5 c8 fe ff ff e8 1a f6 e6 fa <0f> 0b e9 6a fc ff ff e8 0e f6 e6 fa 48 8b 85 d0 fe ff ff 48 8d 78
RSP: 0018:ffff8801a8fcf178 EFLAGS: 00010293
RAX: ffff8801a8eba5c0 RBX: 0000000000000000 RCX: ffffffff869511e6
RDX: 0000000000000000 RSI: ffffffff869515b6 RDI: 0000000000000005
RBP: ffff8801a8fcf2c8 R08: ffff8801a8eba5c0 R09: ffffed0035ac8338
R10: ffffed0035ac8338 R11: ffff8801ad6419c3 R12: ffff8801a8fcf720
R13: ffff8801a8fcf6a0 R14: ffff8801ad6419c0 R15: ffff8801ad641980
ip6_make_skb+0x2c8/0x600 net/ipv6/ip6_output.c:1768
udpv6_sendmsg+0x2c90/0x35f0 net/ipv6/udp.c:1376
inet_sendmsg+0x1a1/0x690 net/ipv4/af_inet.c:798
sock_sendmsg_nosec net/socket.c:641 [inline]
sock_sendmsg+0xd5/0x120 net/socket.c:651
___sys_sendmsg+0x51d/0x930 net/socket.c:2125
__sys_sendmmsg+0x240/0x6f0 net/socket.c:2220
__do_sys_sendmmsg net/socket.c:2249 [inline]
__se_sys_sendmmsg net/socket.c:2246 [inline]
__x64_sys_sendmmsg+0x9d/0x100 net/socket.c:2246
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x446ba9
Code: e8 cc bb 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fb39a469da8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00000000006dcc54 RCX: 0000000000446ba9
RDX: 00000000000000b8 RSI: 0000000020001b00 RDI: 0000000000000003
RBP: 00000000006dcc50 R08: 00007fb39a46a700 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 45c828efc7a64843
R13: e6eeb815b9d8a477 R14: 5068caf6f713c6fc R15: 0000000000000001
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..
Fixes:
|
||
---|---|---|
.. | ||
9p | ||
bluetooth | ||
caif | ||
iucv | ||
netfilter | ||
netns | ||
nfc | ||
phonet | ||
sctp | ||
tc_act | ||
6lowpan.h | ||
act_api.h | ||
addrconf.h | ||
af_ieee802154.h | ||
af_rxrpc.h | ||
af_unix.h | ||
af_vsock.h | ||
ah.h | ||
arp.h | ||
atmclip.h | ||
ax25.h | ||
ax88796.h | ||
bond_3ad.h | ||
bond_alb.h | ||
bond_options.h | ||
bonding.h | ||
busy_poll.h | ||
calipso.h | ||
cfg80211-wext.h | ||
cfg80211.h | ||
cfg802154.h | ||
checksum.h | ||
cipso_ipv4.h | ||
cls_cgroup.h | ||
codel_impl.h | ||
codel_qdisc.h | ||
codel.h | ||
compat.h | ||
datalink.h | ||
dcbevent.h | ||
dcbnl.h | ||
devlink.h | ||
dn_dev.h | ||
dn_fib.h | ||
dn_neigh.h | ||
dn_nsp.h | ||
dn_route.h | ||
dn.h | ||
dsa.h | ||
dsfield.h | ||
dst_cache.h | ||
dst_metadata.h | ||
dst_ops.h | ||
dst.h | ||
erspan.h | ||
esp.h | ||
ethoc.h | ||
failover.h | ||
fib_notifier.h | ||
fib_rules.h | ||
firewire.h | ||
flow_dissector.h | ||
flow.h | ||
fou.h | ||
fq_impl.h | ||
fq.h | ||
garp.h | ||
gen_stats.h | ||
genetlink.h | ||
geneve.h | ||
gre.h | ||
gro_cells.h | ||
gtp.h | ||
gue.h | ||
hwbm.h | ||
icmp.h | ||
ieee80211_radiotap.h | ||
ieee802154_netdev.h | ||
if_inet6.h | ||
ife.h | ||
ila.h | ||
inet6_connection_sock.h | ||
inet6_hashtables.h | ||
inet_common.h | ||
inet_connection_sock.h | ||
inet_ecn.h | ||
inet_frag.h | ||
inet_hashtables.h | ||
inet_sock.h | ||
inet_timewait_sock.h | ||
inetpeer.h | ||
ip6_checksum.h | ||
ip6_fib.h | ||
ip6_route.h | ||
ip6_tunnel.h | ||
ip_fib.h | ||
ip_tunnels.h | ||
ip_vs.h | ||
ip.h | ||
ipcomp.h | ||
ipconfig.h | ||
ipv6.h | ||
ipx.h | ||
iw_handler.h | ||
kcm.h | ||
l3mdev.h | ||
lapb.h | ||
lib80211.h | ||
llc_c_ac.h | ||
llc_c_ev.h | ||
llc_c_st.h | ||
llc_conn.h | ||
llc_if.h | ||
llc_pdu.h | ||
llc_s_ac.h | ||
llc_s_ev.h | ||
llc_s_st.h | ||
llc_sap.h | ||
llc.h | ||
lwtunnel.h | ||
mac80211.h | ||
mac802154.h | ||
mip6.h | ||
mld.h | ||
mpls_iptunnel.h | ||
mpls.h | ||
mrp.h | ||
ncsi.h | ||
ndisc.h | ||
neighbour.h | ||
net_failover.h | ||
net_namespace.h | ||
net_ratelimit.h | ||
netevent.h | ||
netlabel.h | ||
netlink.h | ||
netprio_cgroup.h | ||
netrom.h | ||
nexthop.h | ||
nl802154.h | ||
nsh.h | ||
p8022.h | ||
page_pool.h | ||
ping.h | ||
pkt_cls.h | ||
pkt_sched.h | ||
pptp.h | ||
protocol.h | ||
psample.h | ||
psnap.h | ||
raw.h | ||
rawv6.h | ||
red.h | ||
regulatory.h | ||
request_sock.h | ||
rose.h | ||
route.h | ||
rsi_91x.h | ||
rtnetlink.h | ||
sch_generic.h | ||
scm.h | ||
secure_seq.h | ||
seg6_hmac.h | ||
seg6_local.h | ||
seg6.h | ||
slhc_vj.h | ||
smc.h | ||
snmp.h | ||
sock_reuseport.h | ||
sock.h | ||
Space.h | ||
stp.h | ||
strparser.h | ||
switchdev.h | ||
tcp_states.h | ||
tcp.h | ||
timewait_sock.h | ||
tipc.h | ||
tls.h | ||
transp_v6.h | ||
tso.h | ||
tun_proto.h | ||
udp_tunnel.h | ||
udp.h | ||
udplite.h | ||
vsock_addr.h | ||
vxlan.h | ||
wext.h | ||
wimax.h | ||
x25.h | ||
x25device.h | ||
xdp_sock.h | ||
xdp.h | ||
xfrm.h |