From patchwork Thu Apr 19 16:14:53 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 901357 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.b="TdEm4EZc"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 40RkbV2bBKz9s27 for ; Fri, 20 Apr 2018 02:15:02 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753628AbeDSQO7 (ORCPT ); Thu, 19 Apr 2018 12:14:59 -0400 Received: from mail-pg0-f68.google.com ([74.125.83.68]:45481 "EHLO mail-pg0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752385AbeDSQO6 (ORCPT ); Thu, 19 Apr 2018 12:14:58 -0400 Received: by mail-pg0-f68.google.com with SMTP id i29so1222014pgn.12 for ; Thu, 19 Apr 2018 09:14:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=Y5W3dWXLnAaQTpyGP798sF6mFeOM0CnQSsKwHAoyZzI=; b=TdEm4EZc5+jdLQxtc6OlG2Pu/NChQlyaf/+S5Pr7BDopN5oPMr6TxxuIl9Y0L1SpH4 lhOjr6kj06YE4ZLRHGDy1l4ChuwtEmtik2RYQ79y38iqxsllPFAbT+Lg3VS0gNZE9eyE 1gYI6vvd/JhhfJutapSnVNdcSPRjSyV2dExSRJMgjWRVB1CdRbd3pjzs/kD8ipyT9I9O v14DkkktVV3vJ2ZvhOl52e4tyiXRk1pkxPEmARZBmzYyBUfyTzasP1uSiaFReTyuTuCV S0WeMg3HOTL5FRsCNYjOeMoiAqizQEm2iWpuHr8vm1BKKaXWSrA07U4tFNv8t8wCTkoX 8gZw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=Y5W3dWXLnAaQTpyGP798sF6mFeOM0CnQSsKwHAoyZzI=; b=CQmih3k7Gwrejtb/Z/6IIDDEAp6wrsKslbtwusQhSjE5mXWgH/q+9Izt0xLIxIUQwV b3378HllrNkE2JemQ3lkW+R6r12duyxr6gAKQOXPJiT37vuMSX0NKEyGd+cf9pLCUlou XHyYjuhxmmlOnx2nlQEos6itYOWZJkltP6pD28TtV/Y/jxUXOcX9YuC5cCGob0ad+ajG egqywnXsFfWkmV7EshS9lNsVMznDpLZUgDth2bXvQ4oAKu5Se7sb7K5/rKpDpfgs6gcE jykUrOXdzKEnTl1XVfVoYXVtuz+w4wystZe0rqRuJTX1K+GgUvMgO8f/oQhSOI4Vf2dJ vL8A== X-Gm-Message-State: ALQs6tD/O6PpHf2w+P3949QarCQhKrivjUnFZMc+eMnaBlx/RQJEM64f HB4YtPfOJQ+ooQf8v0H+u8B1Mw== X-Google-Smtp-Source: AIpwx4+lT1umCX1w8zrYcKM84MmmbJUXIo7h4X+boxKCDTr3ip+W+E3CRQg592UFmZ2kdJBVDe8fmg== X-Received: by 10.99.125.74 with SMTP id m10mr5625512pgn.80.1524154497233; Thu, 19 Apr 2018 09:14:57 -0700 (PDT) Received: from localhost ([2620:15c:2c4:1:7e6f:1e60:1805:893c]) by smtp.gmail.com with ESMTPSA id y6sm9898878pfg.121.2018.04.19.09.14.55 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Thu, 19 Apr 2018 09:14:55 -0700 (PDT) From: Eric Dumazet To: "David S . Miller" Cc: netdev , Eric Dumazet , Eric Dumazet , David Ahern Subject: [PATCH net-next] net/ipv6: Fix ip6_convert_metrics() bug Date: Thu, 19 Apr 2018 09:14:53 -0700 Message-Id: <20180419161453.46977-1-edumazet@google.com> X-Mailer: git-send-email 2.17.0.484.g0c8726318c-goog Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org If ip6_convert_metrics() fails to allocate memory, it should not overwrite rt->fib6_metrics or we risk a crash later as syzbot found. BUG: KASAN: null-ptr-deref in atomic_read include/asm-generic/atomic-instrumented.h:21 [inline] BUG: KASAN: null-ptr-deref in refcount_sub_and_test+0x92/0x330 lib/refcount.c:179 Read of size 4 at addr 0000000000000044 by task syzkaller832429/4487 CPU: 1 PID: 4487 Comm: syzkaller832429 Not tainted 4.16.0+ #6 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1b9/0x294 lib/dump_stack.c:113 kasan_report_error mm/kasan/report.c:352 [inline] kasan_report.cold.7+0x6d/0x2fe mm/kasan/report.c:412 check_memory_region_inline mm/kasan/kasan.c:260 [inline] check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267 kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272 atomic_read include/asm-generic/atomic-instrumented.h:21 [inline] refcount_sub_and_test+0x92/0x330 lib/refcount.c:179 refcount_dec_and_test+0x1a/0x20 lib/refcount.c:212 fib6_info_destroy+0x2d0/0x3c0 net/ipv6/ip6_fib.c:206 fib6_info_release include/net/ip6_fib.h:304 [inline] ip6_route_info_create+0x677/0x3240 net/ipv6/route.c:3020 ip6_route_add+0x23/0xb0 net/ipv6/route.c:3030 inet6_rtm_newroute+0x142/0x160 net/ipv6/route.c:4406 rtnetlink_rcv_msg+0x466/0xc10 net/core/rtnetlink.c:4648 netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2448 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4666 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline] netlink_unicast+0x58b/0x740 net/netlink/af_netlink.c:1336 netlink_sendmsg+0x9f0/0xfa0 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:629 [inline] sock_sendmsg+0xd5/0x120 net/socket.c:639 ___sys_sendmsg+0x805/0x940 net/socket.c:2117 __sys_sendmsg+0x115/0x270 net/socket.c:2155 SYSC_sendmsg net/socket.c:2164 [inline] SyS_sendmsg+0x29/0x30 net/socket.c:2162 do_syscall_64+0x29e/0x9d0 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 Fixes: d4ead6b34b67 ("net/ipv6: move metrics from dst to rt6_info") Signed-off-by: Eric Dumazet Cc: David Ahern Reported-by: syzbot Acked-by: David Ahern --- net/ipv6/route.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index f9c363327d620322dda2269d8398a5dc5de7aa4e..9279f4ec84b6b885357390d3de0826a8a4c54daf 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -2600,21 +2600,19 @@ static int ip6_dst_gc(struct dst_ops *ops) static int ip6_convert_metrics(struct net *net, struct fib6_info *rt, struct fib6_config *cfg) { - int err = 0; + struct dst_metrics *p; - if (cfg->fc_mx) { - rt->fib6_metrics = kzalloc(sizeof(*rt->fib6_metrics), - GFP_KERNEL); - if (unlikely(!rt->fib6_metrics)) - return -ENOMEM; + if (!cfg->fc_mx) + return 0; - refcount_set(&rt->fib6_metrics->refcnt, 1); + p = kzalloc(sizeof(*rt->fib6_metrics), GFP_KERNEL); + if (unlikely(!p)) + return -ENOMEM; - err = ip_metrics_convert(net, cfg->fc_mx, cfg->fc_mx_len, - rt->fib6_metrics->metrics); - } + refcount_set(&p->refcnt, 1); + rt->fib6_metrics = p; - return err; + return ip_metrics_convert(net, cfg->fc_mx, cfg->fc_mx_len, p->metrics); } static struct rt6_info *ip6_nh_lookup_table(struct net *net,