On Wed, Sep 19, 2018 at 11:35:36AM -0700, Zubin Mithra wrote:
> From: David Ahern <dsahern@xxxxxxxxx>
>
> commit f7225172f25aaf0dfd9ad65f05be8da5d6108b12 upstream.
>
> syzbot reported a use-after-free:
>
> BUG: KASAN: use-after-free in ip6_route_mpath_notify+0xe9/0x100 net/ipv6/route.c:4180
> Read of size 4 at addr ffff8801bf789cf0 by task syz-executor756/4555
>
> CPU: 1 PID: 4555 Comm: syz-executor756 Not tainted 4.17.0-rc7+ #78
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Call Trace:
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0x1b9/0x294 lib/dump_stack.c:113
> print_address_description+0x6c/0x20b mm/kasan/report.c:256
> kasan_report_error mm/kasan/report.c:354 [inline]
> kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
> __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
> ip6_route_mpath_notify+0xe9/0x100 net/ipv6/route.c:4180
> ip6_route_multipath_add+0x615/0x1910 net/ipv6/route.c:4303
> inet6_rtm_newroute+0xe3/0x160 net/ipv6/route.c:4391
> ...
>
> Allocated by task 4555:
> save_stack+0x43/0xd0 mm/kasan/kasan.c:448
> set_track mm/kasan/kasan.c:460 [inline]
> kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
> kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
> kmem_cache_alloc+0x12e/0x760 mm/slab.c:3554
> dst_alloc+0xbb/0x1d0 net/core/dst.c:104
> __ip6_dst_alloc+0x35/0xa0 net/ipv6/route.c:361
> ip6_dst_alloc+0x29/0xb0 net/ipv6/route.c:376
> ip6_route_info_create+0x4d4/0x3a30 net/ipv6/route.c:2834
> ip6_route_multipath_add+0xc7e/0x1910 net/ipv6/route.c:4240
> inet6_rtm_newroute+0xe3/0x160 net/ipv6/route.c:4391
> ...
>
> Freed by task 4555:
> save_stack+0x43/0xd0 mm/kasan/kasan.c:448
> set_track mm/kasan/kasan.c:460 [inline]
> __kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:521
> kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
> __cache_free mm/slab.c:3498 [inline]
> kmem_cache_free+0x86/0x2d0 mm/slab.c:3756
> dst_destroy+0x267/0x3c0 net/core/dst.c:140
> dst_release_immediate+0x71/0x9e net/core/dst.c:205
> fib6_add+0xa40/0x1650 net/ipv6/ip6_fib.c:1305
> __ip6_ins_rt+0x6c/0x90 net/ipv6/route.c:1011
> ip6_route_multipath_add+0x513/0x1910 net/ipv6/route.c:4267
> inet6_rtm_newroute+0xe3/0x160 net/ipv6/route.c:4391
> ...
>
> The problem is that rt_last can point to a deleted route if the insert
> fails.
>
> One reproducer is to insert a route and then add a multipath route that
> has a duplicate nexthop.e.g,:
> $ ip -6 ro add vrf red 2001:db8:101::/64 nexthop via 2001:db8:1::2
> $ ip -6 ro append vrf red 2001:db8:101::/64 nexthop via 2001:db8:1::4 nexthop via 2001:db8:1::2
>
> Fix by not setting rt_last until the it is verified the insert succeeded.
>
> Backport Note:
> - Upstream has replaced rt6_info usage with fib6_info in 8d1c802b281
> ("net/ipv6: Flip FIB entries to fib6_info")
> - fib6_info_release was introduced upstream in 93531c674315
> ("net/ipv6: separate handling of FIB entries from dst based routes"),
> but is not present in stable kernels; 4.14.y relies on dst_release/
> ip6_rt_put/dst_release_immediate.
Thanks for this, now applied.
greg k-h
