Re: [PATCH v3 net-next 03/15] ipv6: Move some validation from ip6_route_info_create() to rtm_to_fib6_config().

[Kuniyuki Iwashima <kuniyu@amazon.com>]

From: "Lai, Yi" <yi1.lai@linux.intel.com>
Date: Tue, 29 Apr 2025 08:24:08 +0800
> Hi Kuniyuki Iwashima,
> 
> Greetings!
> 
> I used Syzkaller and found that there is KASAN: use-after-free Read in ip6_route_info_create in linux-next tag - next-20250428.
> 
> After bisection and the first bad commit is:
> "
> fa76c1674f2e ipv6: Move some validation from ip6_route_info_create() to rtm_to_fib6_config().
> "
> 
> All detailed into can be found at:
> https://github.com/laifryiee/syzkaller_logs/tree/main/250429_005622_ip6_route_info_create
> Syzkaller repro code:
> https://github.com/laifryiee/syzkaller_logs/tree/main/250429_005622_ip6_route_info_create/repro.c
> Syzkaller repro syscall steps:
> https://github.com/laifryiee/syzkaller_logs/tree/main/250429_005622_ip6_route_info_create/repro.prog
> Syzkaller report:
> https://github.com/laifryiee/syzkaller_logs/tree/main/250429_005622_ip6_route_info_create/repro.report
> Kconfig(make olddefconfig):
> https://github.com/laifryiee/syzkaller_logs/tree/main/250429_005622_ip6_route_info_create/kconfig_origin
> Bisect info:
> https://github.com/laifryiee/syzkaller_logs/tree/main/250429_005622_ip6_route_info_create/bisect_info.log
> bzImage:
> https://github.com/laifryiee/syzkaller_logs/raw/refs/heads/main/250429_005622_ip6_route_info_create/bzImage_33035b665157558254b3c21c3f049fd728e72368
> Issue dmesg:
> https://github.com/laifryiee/syzkaller_logs/blob/main/250429_005622_ip6_route_info_create/33035b665157558254b3c21c3f049fd728e72368_dmesg.log
> 
> "
> [   17.307248] ==================================================================
> [   17.307611] BUG: KASAN: slab-use-after-free in ip6_route_info_create+0xb84/0xc30
> [   17.307993] Read of size 1 at addr ffff8880100b8a94 by task repro/727
> [   17.308291] 
> [   17.308389] CPU: 0 UID: 0 PID: 727 Comm: repro Not tainted 6.15.0-rc4-next-20250428-33035b665157 #1 PREEMPT(voluntary) 
> [   17.308397] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
> [   17.308405] Call Trace:
> [   17.308412]  <TASK>
> [   17.308414]  dump_stack_lvl+0xea/0x150
> [   17.308439]  print_report+0xce/0x660
> [   17.308469]  ? ip6_route_info_create+0xb84/0xc30
> [   17.308475]  ? kasan_complete_mode_report_info+0x80/0x200
> [   17.308482]  ? ip6_route_info_create+0xb84/0xc30
> [   17.308489]  kasan_report+0xd6/0x110
> [   17.308496]  ? ip6_route_info_create+0xb84/0xc30
> [   17.308504]  __asan_report_load1_noabort+0x18/0x20
> [   17.308509]  ip6_route_info_create+0xb84/0xc30
> [   17.308516]  ip6_route_add+0x32/0x320
> [   17.308524]  ipv6_route_ioctl+0x414/0x5a0

Thanks for the report.

It seems I accidentally removed validation from the ioctl path,
not sure why I missed the path...

Will post a fix soon.