In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv4: fib: Don’t dump dying fib_info in fib_leaf_notify().<\/p>\n
syzbot reported use-after-free in nsim_fib4_prepare_event(). [0]<\/p>\n
The problem is that the following functions call fib_info_hold() \/
\nrefcount_inc() while dumping fib_info under RCU, which is unsafe.<\/p>\n
* mlxsw_sp_router_fib4_event()
\n * rocker_router_fib_event()
\n * nsim_fib4_prepare_event()<\/p>\n
refcount_inc_not_zero() must be used, but it would be too late
\nthere.<\/p>\n
Let’s guarantee the lifetime of fib_info in fib_leaf_notify().<\/p>\n
Note that IPv6 does not need the corresponding change since
\nfib6_table_dump() holds fib6_table.tb6_lock.<\/p>\n
[0]:
\nrefcount_t: addition on 0; use-after-free.
\nWARNING: lib\/refcount.c:25 at refcount_warn_saturate+0x9f\/0x110 lib\/refcount.c:25, CPU#0: kworker\/u8:15\/3420
\nModules linked in:
\nCPU: 0 UID: 0 PID: 3420 Comm: kworker\/u8:15 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
\nHardware name: Google Google Compute Engine\/Google Compute Engine, BIOS Google 04\/18\/2026
\nWorkqueue: netns cleanup_net
\nRIP: 0010:refcount_warn_saturate+0x9f\/0x110 lib\/refcount.c:25
\nCode: eb 66 85 db 74 3e 83 fb 01 75 4c e8 1b f1 22 fd 48 8d 3d 84 cb f1 0a 67 48 0f b9 3a eb 4a e8 08 f1 22 fd 48 8d 3d 81 cb f1 0a 48 0f b9 3a eb 37 e8 f5 f0 22 fd 48 8d 3d 7e cb f1 0a 67 48 0f
\nRSP: 0018:ffffc9000f2c7270 EFLAGS: 00010293
\nRAX: ffffffff84a18858 RBX: 0000000000000002 RCX: ffff888032ff9ec0
\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8f9353e0
\nRBP: 0000000000000000 R08: ffff888032ff9ec0 R09: 0000000000000005
\nR10: 0000000000000100 R11: 0000000000000004 R12: ffff8880570cc000
\nR13: dffffc0000000000 R14: ffff88802b40563c R15: ffff8880570cc000
\nFS: 0000000000000000(0000) GS:ffff888126173000(0000) knlGS:0000000000000000
\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
\nCR2: 00007fb1f4d5d000 CR3: 000000006072a000 CR4: 00000000003526f0
\nCall Trace:<\/p>\n
__refcount_add include\/linux\/refcount.h:-1 [inline]
\n __refcount_inc include\/linux\/refcount.h:366 [inline]
\n refcount_inc include\/linux\/refcount.h:383 [inline]
\n fib_info_hold include\/net\/ip_fib.h:629 [inline]
\n nsim_fib4_prepare_event drivers\/net\/netdevsim\/fib.c:930 [inline]
\n nsim_fib_event_schedule_work drivers\/net\/netdevsim\/fib.c:1000 [inline]
\n nsim_fib_event_nb+0x1055\/0x1240 drivers\/net\/netdevsim\/fib.c:1043
\n call_fib_notifier+0x45\/0x80 net\/core\/fib_notifier.c:25
\n call_fib_entry_notifier net\/ipv4\/fib_trie.c:90 [inline]
\n fib_leaf_notify net\/ipv4\/fib_trie.c:2176 [inline]
\n fib_table_notify net\/ipv4\/fib_trie.c:2194 [inline]
\n fib_notify+0x36b\/0x5e0 net\/ipv4\/fib_trie.c:2217
\n fib_net_dump net\/core\/fib_notifier.c:70 [inline]
\n register_fib_notifier+0x184\/0x360 net\/core\/fib_notifier.c:108
\n nsim_fib_create+0x85d\/0x9f0 drivers\/net\/netdevsim\/fib.c:1596
\n nsim_dev_reload_create drivers\/net\/netdevsim\/dev.c:1604 [inline]
\n nsim_dev_reload_up+0x374\/0x7c0 drivers\/net\/netdevsim\/dev.c:1058
\n devlink_reload+0x501\/0x8d0 net\/devlink\/dev.c:475
\n devlink_pernet_pre_exit+0x1ff\/0x420 net\/devlink\/core.c:558
\n ops_pre_exit_list net\/core\/net_namespace.c:161 [inline]
\n ops_undo_list+0x187\/0x940 net\/core\/net_namespace.c:234
\n cleanup_net+0x56e\/0x800 net\/core\/net_namespace.c:702
\n process_one_work kernel\/workqueue.c:3314 [inline]
\n process_scheduled_works+0xb5d\/0x1860 kernel\/workqueue.c:3397
\n worker_thread+0xa53\/0xfc0 kernel\/workqueue.c:3478
\n kthread+0x388\/0x470 kernel\/kthread.c:436
\n ret_from_fork+0x514\/0xb70 arch\/x86\/kernel\/process.c:158
\n ret_from_fork_asm+0x1a\/0x30 arch\/x86\/entry\/entry_64.S:245<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv4: fib: Don’t dump dying fib_info in fib_leaf_notify().<\/p>\n
syzbot reported use-after-free in nsim_fib4_prepare_event(). [0]<\/p>\n
The p<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7228","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}