In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv6: Prevent rt6_insert_exception() for dying fib6_info.<\/p>\n
Before the cited commit, fib6_nh_flush_exceptions() always set
\nfrom->exception_bucket_flushed = 1 under rt6_exception_lock to
\nprevent rt6_insert_exception() from inserting a new exception
\nfor a dying fib6_info.<\/p>\n
The flag was replaced with the FIB6_EXCEPTION_BUCKET_FLUSHED
\nbit stored in nh->rt6i_exception_bucket.<\/p>\n
The problem is that now the bit is only set when the bucket
\nis not NULL and fib6_nh_flush_exceptions() is called from
\nfib6_nh_release() after fib6_ref has already reached zero.<\/p>\n
If rt6_insert_exception() is called while the target fib6_info
\nis being removed via fib6_purge_rt(), a new exception could be
\ncreated successfully because rt6_flush_exceptions() no longer
\nsets the bit.<\/p>\n
This creates a reference cycle between the fib6_info and the
\nexception route, leaking the fib6_info, its nexthop device,
\nand all per-CPU routes in fib6_nh->rt6i_pcpu, which stalls netdev
\nunregistration.<\/p>\n
[ 34.680602] unregister_netdevice: waiting for gre6 to become free. Usage count = 68
\n[ 44.920675] unregister_netdevice: waiting for gre6 to become free. Usage count = 68
\n[ 55.176582] unregister_netdevice: waiting for gre6 to become free. Usage count = 68<\/p>\n
Let’s call fib6_drop_pcpu_from() before rt6_flush_exceptions(),
\nto set fib6_destroying before rt6_exception_lock, and check
\nf6i->fib6_destroying in rt6_insert_exception().<\/p>\n
Note that FIB6_EXCEPTION_BUCKET_FLUSHED logic is dead and
\nwe can clean it up in net-next.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv6: Prevent rt6_insert_exception() for dying fib6_info.<\/p>\n
Before the cited commit, fib6_nh_flush_exceptions() always set
\nfrom->exc<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41070","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41070","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41070"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41070"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41070"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}