From patchwork Thu Jan 18 18:40:03 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wei Wang X-Patchwork-Id: 863081 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.b="PhE04P6g"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3zMt73759vz9sNr for ; Fri, 19 Jan 2018 05:40:15 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932532AbeARSkN (ORCPT ); Thu, 18 Jan 2018 13:40:13 -0500 Received: from mail-pg0-f66.google.com ([74.125.83.66]:33030 "EHLO mail-pg0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932446AbeARSkL (ORCPT ); Thu, 18 Jan 2018 13:40:11 -0500 Received: by mail-pg0-f66.google.com with SMTP id u1so1569067pgr.0 for ; Thu, 18 Jan 2018 10:40:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=xIUoltaXQxHztH4aPkNUCiFPxOPSNZziGtrimorQSCc=; b=PhE04P6gZeLrQAUaU7xoJIiwMXJLfSnbr4nqy5fEWkWcNn22Y06jUpezHAKynLTe3O 73VDDOWRqxVob5c9Vw1OJSaNpjPqatVNz0Y5VuqwdnHOGcUQmkmXsmN1XqBOiTPa37sj Du6OXnva1i53uZAMI1AwA43/lQDyoDxOvWwNrO9WzmM8mPQXtJM37rybB+H05hsHulta Lv2/RKuH5z2spWJ9LXIILXI9MvjumgV6Aahb3OiSM+X1I3JXxmo4fiP7CZZc1bJ2sKT6 Wi+CqM1v3iOpm4XCh0zEfYxCNqv8sxlXqfWW1vkjtoAjIMkSukf8/eJVs8VM/cyTQqTd xfjw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=xIUoltaXQxHztH4aPkNUCiFPxOPSNZziGtrimorQSCc=; b=mlwUQoQwRcRvpis6SRLK5iX2PWFd5AOPRVeXWrIwqR0zpVlP7QEeGv/VlyB5H8yTmJ H3/Jslw5BQzNufN8P1Lxw38BHFO2vtQ9ErzWARBqys86Dx9HkhpnROR/gqPlFZfux1DH xJf8B053QoXlJfpwtdbO+mOepW5kjcCHzpQlmVu5MqC/QmtZkX/7V8brRWqpC9/FjF95 CNj/0x6te+n7SrmLYbh7ak8fdzHXQncd4eqzoqoAHOzjrXbR+0BYd3c4g/uh+RkPjTPd W/ahDgh+Q6pBzikuYumACbeXb6q0HwPpm6x7Ffxlzj1VgLH2ufo0d9yApxC6i289ZPGW kZlg== X-Gm-Message-State: AKGB3mIwCZ5ZDH/ddWy2WEV0gMxM5lZiklDeBYnLkCPOT9Lp7KDEkwcw iAQx8dQwJEiAP3YCQtD6DOBohg== X-Google-Smtp-Source: ACJfBotp2aos+AfPqqzFe4TmEoP3uS4qIwnmwHv6f10h5b3UsYUT3GEc+daGRwxjbmhM7r5klDQ7yg== X-Received: by 10.99.99.199 with SMTP id x190mr33196211pgb.193.1516300810172; Thu, 18 Jan 2018 10:40:10 -0800 (PST) Received: from localhost ([2620:15c:2c4:201:1098:761a:d957:9552]) by smtp.gmail.com with ESMTPSA id k62sm12194762pga.42.2018.01.18.10.40.09 (version=TLS1_2 cipher=AES128-SHA bits=128/128); Thu, 18 Jan 2018 10:40:09 -0800 (PST) From: Wei Wang X-Google-Original-From: Wei Wang To: David Miller , netdev@vger.kernel.org Cc: Eric Dumazet , Martin KaFai Lau , Wei Wang Subject: [PATCH net] ipv6: don't let tb6_root node share routes with other node Date: Thu, 18 Jan 2018 10:40:03 -0800 Message-Id: <20180118184003.82818-1-tracywwnj@gmail.com> X-Mailer: git-send-email 2.16.0.rc1.238.g530d649a79-goog Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Wei Wang After commit 4512c43eac7e, if we add a route to the subtree of tb6_root which does not have any route attached to it yet, the current code will let tb6_root and the node in the subtree share the same route. This could cause problem cause tb6_root has RTN_INFO flag marked and the tree repair and clean up code will not work properly. This commit makes sure tb6_root->leaf points back to null_entry instead of sharing route with other node. It fixes the following syzkaller reported issue: BUG: KASAN: use-after-free in ipv6_prefix_equal include/net/ipv6.h:540 [inline] BUG: KASAN: use-after-free in fib6_add_1+0x165f/0x1790 net/ipv6/ip6_fib.c:618 Read of size 8 at addr ffff8801bc043498 by task syz-executor5/19819 CPU: 1 PID: 19819 Comm: syz-executor5 Not tainted 4.15.0-rc7+ #186 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 print_address_description+0x73/0x250 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report+0x25b/0x340 mm/kasan/report.c:409 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430 ipv6_prefix_equal include/net/ipv6.h:540 [inline] fib6_add_1+0x165f/0x1790 net/ipv6/ip6_fib.c:618 fib6_add+0x5fa/0x1540 net/ipv6/ip6_fib.c:1214 __ip6_ins_rt+0x6c/0x90 net/ipv6/route.c:1003 ip6_route_add+0x141/0x190 net/ipv6/route.c:2790 ipv6_route_ioctl+0x4db/0x6b0 net/ipv6/route.c:3299 inet6_ioctl+0xef/0x1e0 net/ipv6/af_inet6.c:520 sock_do_ioctl+0x65/0xb0 net/socket.c:958 sock_ioctl+0x2c2/0x440 net/socket.c:1055 vfs_ioctl fs/ioctl.c:46 [inline] do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692 entry_SYSCALL_64_fastpath+0x23/0x9a RIP: 0033:0x452ac9 RSP: 002b:00007fd42b321c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000071bea0 RCX: 0000000000452ac9 RDX: 0000000020fd7000 RSI: 000000000000890b RDI: 0000000000000013 RBP: 000000000000049e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f4f70 R13: 00000000ffffffff R14: 00007fd42b3226d4 R15: 0000000000000000 Fixes: 4512c43eac7e ("ipv6: remove null_entry before adding default route") Signed-off-by: Wei Wang Acked-by: Eric Dumazet Acked-by: Martin KaFai Lau --- net/ipv6/ip6_fib.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c index 9dcc3924a975..217683d40f12 100644 --- a/net/ipv6/ip6_fib.c +++ b/net/ipv6/ip6_fib.c @@ -1226,8 +1226,14 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, } if (!rcu_access_pointer(fn->leaf)) { - atomic_inc(&rt->rt6i_ref); - rcu_assign_pointer(fn->leaf, rt); + if (fn->fn_flags & RTN_TL_ROOT) { + /* put back null_entry for root node */ + rcu_assign_pointer(fn->leaf, + info->nl_net->ipv6.ip6_null_entry); + } else { + atomic_inc(&rt->rt6i_ref); + rcu_assign_pointer(fn->leaf, rt); + } } fn = sn; }