Skip to content
  • Eric Dumazet's avatar
    ipmr: properly check rhltable_init() return value · 66fb3325
    Eric Dumazet authored
    commit 8fb472c0 ("ipmr: improve hash scalability")
    added a call to rhltable_init() without checking its return value.
    
    This problem was then later copied to IPv6 and factorized in commit
    0bbbf0e7 ("ipmr, ip6mr: Unite creation of new mr_table")
    
    kasan: CONFIG_KASAN_INLINE enabled
    kasan: GPF could be caused by NULL-ptr deref or user memory access
    general protection fault: 0000 [#1] SMP KASAN
    Dumping ftrace buffer:
       (ftrace buffer empty)
    Modules linked in:
    CPU: 1 PID: 31552 Comm: syz-executor7 Not tainted 4.17.0-rc5+ #60
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    RIP: 0010:rht_key_hashfn include/linux/rhashtable.h:277 [inline]
    RIP: 0010:__rhashtable_lookup include/linux/rhashtable.h:630 [inline]
    RIP: 0010:rhltable_lookup include/linux/rhashtable.h:716 [inline]
    RIP: 0010:mr_mfc_find_parent+0x2ad/0xbb0 net/ipv4/ipmr_base.c:63
    RSP: 0018:ffff8801826aef70 EFLAGS: 00010203
    RAX: 0000000000000001 RBX: 0000000000000001 RCX: ffffc90001ea0000
    RDX: 0000000000000079 RSI: ffffffff8661e859 RDI: 000000000000000c
    RBP: ffff8801826af1c0 R08: ffff8801b2212000 R09: ffffed003b5e46c2
    R10: ffffed003b5e46c2 R11: ffff8801daf23613 R12: dffffc0000000000
    R13: ffff8801826af198 R14: ffff8801cf8225c0 R15: ffff8801826af658
    FS:  00007ff7fa732700(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00000003ffffff9c CR3: 00000001b0210000 CR4: 00000000001406e0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    Call Trace:
     ip6mr_cache_find_parent net/ipv6/ip6mr.c:981 [inline]
     ip6mr_mfc_delete+0x1fe/0x6b0 net/ipv6/ip6mr.c:1221
     ip6_mroute_setsockopt+0x15c6/0x1d70 net/ipv6/ip6mr.c:1698
     do_ipv6_setsockopt.isra.9+0x422/0x4660 net/ipv6/ipv6_sockglue.c:163
     ipv6_setsockopt+0xbd/0x170 net/ipv6/ipv6_sockglue.c:922
     rawv6_setsockopt+0x59/0x140 net/ipv6/raw.c:1060
     sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3039
     __sys_setsockopt+0x1bd/0x390 net/socket.c:1903
     __do_sys_setsockopt net/socket.c:1914 [inline]
     __se_sys_setsockopt net/socket.c:1911 [inline]
     __x64_sys_setsockopt+0xbe/0x150 net/socket.c:1911
     do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
     entry_SYSCALL_64_after_hwframe+0x49/0xbe
    
    Fixes: 8fb472c0 ("ipmr: improve hash scalability")
    Fixes: 0bbbf0e7
    
     ("ipmr, ip6mr: Unite creation of new mr_table")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Cc: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
    Cc: Yuval Mintz <yuvalm@mellanox.com>
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Acked-by: default avatarNikolay Aleksandrov <nikolay@cumulusnetworks.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    66fb3325