Re: [PATCH net-next] ipv6: add debug checks in fib6_info_release()

[Kui-Feng Lee <sinquersw@gmail.com>]

On 12/7/23 05:29, Eric Dumazet wrote:
> On Thu, Dec 7, 2023 at 4:10 AM <patchwork-bot+netdevbpf@kernel.org> wrote:
>>
>> Hello:
>>
>> This patch was applied to netdev/net-next.git (main)
>> by Jakub Kicinski <kuba@kernel.org>:
>>
>> On Tue,  5 Dec 2023 17:32:50 +0000 you wrote:
>>> Some elusive syzbot reports are hinting to fib6_info_release(),
>>> with a potential dangling f6i->gc_link anchor.
>>>
>>> Add debug checks so that syzbot can catch the issue earlier eventually.
>>>
>>> BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline]
>>> BUG: KASAN: slab-use-after-free in hlist_del_init include/linux/list.h:1016 [inline]
>>> BUG: KASAN: slab-use-after-free in fib6_clean_expires_locked include/net/ip6_fib.h:533 [inline]
>>> BUG: KASAN: slab-use-after-free in fib6_purge_rt+0x986/0x9c0 net/ipv6/ip6_fib.c:1064
>>> Write of size 8 at addr ffff88802805a840 by task syz-executor.1/10057
>>>
>>> [...]
>>
>> Here is the summary with links:
>>    - [net-next] ipv6: add debug checks in fib6_info_release()
>>      https://git.kernel.org/netdev/net-next/c/5a08d0065a91
> 
> Nice, syzbot gave me exactly what I was looking for.
> 
> WARNING: CPU: 0 PID: 5059 at include/net/ip6_fib.h:332
> fib6_info_release include/net/ip6_fib.h:332 [inline]
> WARNING: CPU: 0 PID: 5059 at include/net/ip6_fib.h:332
> ip6_route_info_create+0x1a1a/0x1f10 net/ipv6/route.c:3829
> Modules linked in:
> CPU: 0 PID: 5059 Comm: syz-executor256 Not tainted
> 6.7.0-rc3-syzkaller-00805-g5a08d0065a91 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine,
> BIOS Google 11/10/2023
> RIP: 0010:fib6_info_release include/net/ip6_fib.h:332 [inline]
> RIP: 0010:ip6_route_info_create+0x1a1a/0x1f10 net/ipv6/route.c:3829
> Code: 49 83 7f 40 00 75 28 e8 04 ae 50 f8 49 8d bf a0 00 00 00 48 c7
> c6 c0 ae 37 89 e8 41 2c 3a f8 e9 65 f4 ff ff e8 e7 ad 50 f8 90 <0f> 0b
> 90 eb ad e8 dc ad 50 f8 90 0f 0b 90 eb cd e8 d1 ad 50 f8 e8
> RSP: 0018:ffffc90003bdf8e0 EFLAGS: 00010293
> RAX: 0000000000000000 RBX: 0000000000400000 RCX: ffffffff8936e418
> RDX: ffff888026a58000 RSI: ffffffff8936e469 RDI: 0000000000000005
> RBP: ffffc90003bdf9d0 R08: 0000000000000005 R09: 0000000000000000
> R10: 0000000000400000 R11: ffffffff81de4c35 R12: ffffffffffffffea
> R13: ffff88802993242c R14: ffffc90003bdfac4 R15: ffff888029932400
> FS: 00005555562b4380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00000000004585c0 CR3: 000000007390d000 CR4: 00000000003506f0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <TASK>
> ip6_route_add+0x26/0x1f0 net/ipv6/route.c:3843
> ipv6_route_ioctl+0x3ff/0x590 net/ipv6/route.c:4467
> inet6_ioctl+0x265/0x2b0 net/ipv6/af_inet6.c:575
> sock_do_ioctl+0x113/0x270 net/socket.c:1220
> sock_ioctl+0x22e/0x6b0 net/socket.c:1339
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:871 [inline]
> __se_sys_ioctl fs/ioctl.c:857 [inline]
> __x64_sys_ioctl+0x18f/0x210 fs/ioctl.c:857
> do_syscall_x64 arch/x86/entry/common.c:51 [inline]
> do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
> entry_SYSCALL_64_after_hwframe+0x63/0x6b
> RIP: 0033:0x7f175790d369
> 
> 
> Following commit seems buggy.
> 
> commit 3dec89b14d37ee635e772636dad3f09f78f1ab87
> Author: Kui-Feng Lee <thinker.li@gmail.com>
> Date:   Tue Aug 15 11:07:05 2023 -0700
> 
>      net/ipv6: Remove expired routes with a separated list of routes.
> 
>      FIB6 GC walks trees of fib6_tables to remove expired routes. Walking a tree
>      can be expensive if the number of routes in a table is big, even if most of
>      them are permanent. Checking routes in a separated list of routes having
>      expiration will avoid this potential issue.
> 
>      Signed-off-by: Kui-Feng Lee <thinker.li@gmail.com>
>      Reviewed-by: David Ahern <dsahern@kernel.org>
>      Signed-off-by: David S. Miller <davem@davemloft.net>
> 

Do you happen to have a test program that can reproduce it?