mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-30 16:53:20 -04:00
Code Issues Packages Projects Releases Wiki Activity

ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump

Browse Source 
inet6_dump_fib() saves its progress in cb->args[1] as a positional
index within the current hash chain.  Between batches, a concurrent
fib6_new_table() can insert a new table at the chain head, shifting
all existing entries.  The saved index then lands on a different
table, causing fib6_dump_table() to set w->root to the wrong table
while w->node still points into the previous one.
fib6_walk_continue() dereferences w->node->parent (NULL) and panics:

  BUG: kernel NULL pointer dereference, address: 0000000000000008
  RIP: 0010:fib6_walk_continue+0x6e/0x170
  Call Trace:
   <TASK>
   fib6_dump_table.isra.0+0xc5/0x240
   inet6_dump_fib+0xf6/0x420
   rtnl_dumpit+0x30/0xa0
   netlink_dump+0x15b/0x460
   netlink_recvmsg+0x1d6/0x2a0
   ____sys_recvmsg+0x17a/0x190

Fix by storing tb->tb6_id in cb->args[1] instead of a positional
index.  On resume, skip entries until the id matches; a concurrent
head-insert can never match the saved id, so the walker always
resumes on the correct table.

Fixes: 1b43af5480 ("[IPV6]: Increase number of possible routing tables to 2^32")
Signed-off-by: Pengfei Zhang <zhangfeionline@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260625070517.965597-1-zhangfeionline@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Pengfei Zhang
2026-06-25 15:05:17 +08:00
committed by Jakub Kicinski
parent 622df5e337
commit 9facb861dc
1 changed files with 8 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
net/ipv6/ip6_fib.c
View File

@@ -636,12 +636,12 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
}; };
const struct nlmsghdr *nlh = cb->nlh; const struct nlmsghdr *nlh = cb->nlh;
struct net *net = sock_net(skb->sk); struct net *net = sock_net(skb->sk);
unsigned int e = 0, s_e;
struct hlist_head *head; struct hlist_head *head;
struct fib6_walker *w; struct fib6_walker *w;
struct fib6_table *tb; struct fib6_table *tb;
unsigned int h, s_h; unsigned int h, s_h;
int err = 0; int err = 0;
u32 s_id;
rcu_read_lock(); rcu_read_lock();
if (cb->strict_check) { if (cb->strict_check) {
@@ -701,23 +701,22 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
} }
s_h = cb->args[0]; s_h = cb->args[0];
s_e = cb->args[1]; s_id = cb->args[1];
for (h = s_h; h < FIB6_TABLE_HASHSZ; h++, s_e = 0) { for (h = s_h; h < FIB6_TABLE_HASHSZ; h++, s_id = 0) {
e = 0;
head = &net->ipv6.fib_table_hash[h]; head = &net->ipv6.fib_table_hash[h];
hlist_for_each_entry_rcu(tb, head, tb6_hlist) { hlist_for_each_entry_rcu(tb, head, tb6_hlist) {
if (e < s_e) if (s_id && tb->tb6_id != s_id)
goto next; continue;
s_id = 0;
cb->args[1] = tb->tb6_id;
err = fib6_dump_table(tb, skb, cb); err = fib6_dump_table(tb, skb, cb);
if (err != 0) if (err != 0)
goto out; goto out;
next:
e++;
} }
} }
out: out:
cb->args[1] = e;
cb->args[0] = h; cb->args[0] = h;
unlock: unlock: