github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 01:32:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
master
linux/net/ipv6
History
Nikola Z. Ivanov 313a123e1f ipv6: Change allocation flags to match rcu_read_lock section requirements 
Since the call to __ip6_del_rt_siblings has been converted under
rcu read lock and it only has one call point
we should no longer block or yield.

Our stack trace from the syzbot reproducer looks as follows:

__ip6_del_rt_siblings
  rtnl_notify (Here we pass gfp_any() -> GFP_KERNEL)
    nlmsg_notify
      nlmsg_multicast
        nlmsg_multicast_filtered
          netlink_broadcast_filtered (GFP_KERNEL passed from earlier)

netlink_broadcast_filtered can yield if GFP_KERNEL
is passed, which we do not want to happen.

Fix this by changing the allocation flag of rtnl_notify.

Also change the flag passed to nlmsg_new. Even though it
is not related to the syzbot generated bug it still falls
under the same requirements.

Reported-by: syzbot+84d4a405ed798b40c96d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=84d4a405ed798b40c96d
Fixes: bd11ff421d ("ipv6: Get rid of RTNL for SIOCDELRT and RTM_DELROUTE.")
Signed-off-by: Nikola Z. Ivanov <zlatistiv@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260719105759.558050-1-zlatistiv@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-23 09:13:13 -07:00
..
ila ila: reload IPv6 header after pskb_may_pull in checksum adjust 2026-07-22 14:00:41 -07:00
netfilter netfilter: handle unreadable frags 2026-07-08 15:33:44 +02:00
addrconf_core.c ipv6: remove obsolete EXPORT_SYMBOL() and EXPORT_SYMBOL_GPL() 2026-06-05 17:47:42 -07:00
addrconf.c ipv6: fix missing notification for ignore_routes_with_linkdown 2026-06-23 19:12:48 -07:00
addrlabel.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
af_inet6.c tcp: rehash onto different local ECMP path on retransmit timeout 2026-06-15 15:57:31 -07:00
ah6.c xfrm: ah: use skb_to_full_sk in async output callbacks 2026-05-16 10:56:14 +02:00
anycast.c ipv6: anycast: insert aca into global hash under idev->lock 2026-06-02 19:30:39 -07:00
calipso.c Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
datagram.c ipv6: validate extension header length before copying to cmsg 2026-05-26 18:53:10 -07:00
esp6_offload.c xfrm: Fix inner mode lookup in tunnel mode GSO segmentation 2025-12-04 09:54:53 +01:00
esp6.c esp: fix page frag reference leak on skb_to_sgvec failure 2026-06-09 15:58:17 +02:00
exthdrs_core.c ipv6: Implement limits on extension header parsing 2026-04-30 17:21:45 -07:00
exthdrs_offload.c
exthdrs.c ipv6: exthdrs: recompute network header pointer once 2026-06-03 19:14:56 -07:00
fib6_notifier.c net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
fib6_rules.c ipv6: export fib6_lookup for nft_fib_ipv6 2026-03-04 11:45:44 +01:00
fou6.c fou: Remove IPPROTO_UDPLITE check in gue_err() and gue6_err(). 2026-03-17 16:10:59 -07:00
icmp.c ipv6: fix possible UAF in icmpv6_rcv() 2026-04-18 12:09:52 -07:00
inet6_connection_sock.c tcp: rehash onto different local ECMP path on retransmit timeout 2026-06-15 15:57:31 -07:00
inet6_hashtables.c tcp: use __jhash_final() in inet6_ehashfn() 2026-03-29 11:45:48 -07:00
ioam6_iptunnel.c ipv6: ioam: fix type confusion of dst_entry 2026-06-21 15:26:40 -07:00
ioam6.c net: ioam6: no longer acquire qdisc spinlock while calling qdisc_qstats_qlen_backlog() 2026-05-14 17:05:20 -07:00
ip6_checksum.c udp: Remove UDPLITE_SEND_CSCOV and UDPLITE_RECV_CSCOV. 2026-03-13 18:57:45 -07:00
ip6_fib.c ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump 2026-06-29 18:28:41 -07:00
ip6_flowlabel.c ipv6: use READ_ONCE() in ipv6_flowlabel_get() 2026-06-04 18:31:18 -07:00
ip6_gre.c net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM 2026-07-23 13:01:57 +02:00
ip6_icmp.c ipv6: remove dynamic ICMPv6 sender registration infrastructure 2026-03-29 11:21:23 -07:00
ip6_input.c ipv6: Implement limits on extension header parsing 2026-04-30 17:21:45 -07:00
ip6_offload.c net: pppoe: implement GRO/GSO support 2026-05-19 09:47:53 +02:00
ip6_offload.h
ip6_output.c ipv6: account for fraggap on the paged allocation path 2026-06-21 15:24:49 -07:00
ip6_tunnel.c netfilter: flowtable: fix and simplify IP6IP6 tunnel handling 2026-06-19 12:22:29 +02:00
ip6_udp_tunnel.c udp_tunnel: Pass struct sock to udp_tunnel6_dst_lookup(). 2026-05-05 17:47:04 -07:00
ip6_vti.c net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink 2026-06-17 16:01:52 -07:00
ip6mr.c ipmr: Convert mr_table.cache_resolve_queue_len to u32. 2026-06-11 15:17:30 -07:00
ipcomp6.c xfrm: add extack to xfrm_init_state 2026-06-04 12:22:35 +02:00
ipv6_sockglue.c ipv6: Remove UDP-Lite support for IPV6_ADDRFORM. 2026-03-13 18:57:44 -07:00
Kconfig ipv6: default IPV6_SIT to m 2026-05-05 17:31:51 -07:00
Makefile netfilter: add option for GCOV profiling 2026-05-24 22:55:47 +02:00
mcast_snoop.c
mcast.c ipv6: mcast: Fix potential UAF in MLD delayed work 2026-07-08 14:41:01 +02:00
mip6.c net: fill in MODULE_DESCRIPTION()s for ipv6 modules 2024-02-09 14:12:01 -08:00
ndisc.c ipv6: ndisc: fix NULL deref in accept_untracked_na() 2026-06-21 15:13:24 -07:00
netfilter.c netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() 2026-07-10 16:28:47 +02:00
output_core.c ipv6: remove obsolete EXPORT_SYMBOL() and EXPORT_SYMBOL_GPL() 2026-06-05 17:47:42 -07:00
ping.c net: remove addr_len argument of recvmsg() handlers 2026-03-02 18:17:17 -08:00
proc.c udp: Remove UDP-Lite SNMP stats. 2026-03-13 18:57:44 -07:00
protocol.c
raw.c net: ipv6: fix dif and sdif mismatch in raw6_icmp_error 2026-07-23 08:31:44 -07:00
reassembly.c ipv6: frags: cleanup __IP6_INC_STATS() confusion 2026-05-27 17:27:26 -07:00
route.c ipv6: Change allocation flags to match rcu_read_lock section requirements 2026-07-23 09:13:13 -07:00
rpl_iptunnel.c net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels 2026-04-28 11:16:14 +02:00
rpl.c
seg6_hmac.c ipv6: add NULL checks for idev in SRv6 paths 2026-03-18 17:23:43 -07:00
seg6_iptunnel.c net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels 2026-04-28 11:16:14 +02:00
seg6_local.c ipv6: adopt dst_dev() helper 2025-07-02 14:32:30 -07:00
seg6.c seg6: validate SRH length before reading fixed fields 2026-06-26 18:49:37 -07:00
sit.c net: sit: require CAP_NET_ADMIN in the device netns for changelink 2026-06-21 15:10:06 -07:00
syncookies.c tcp: rehash onto different local ECMP path on retransmit timeout 2026-06-15 15:57:31 -07:00
sysctl_net_ipv6.c sysctl: treewide: constify the ctl_table argument of proc_handlers 2024-07-24 20:59:29 +02:00
tcp_ao.c net/tcp-ao: Return void from functions that can no longer fail 2026-04-30 09:38:56 +02:00
tcp_ipv6.c tcp: initialize standalone TCP-AO response padding 2026-07-21 15:24:36 -07:00
tcpv6_offload.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-01-29 17:28:54 -08:00
tunnel6.c net: fill in MODULE_DESCRIPTION()s for ipv6 modules 2024-02-09 14:12:01 -08:00
udp_offload.c udp: Don't pass udptable to IPv6 socket lookup functions. 2026-03-13 18:57:46 -07:00
udp.c udp: Force compute_score to always inline 2026-04-13 15:44:42 -07:00
xfrm6_input.c xfrm: Fix dev use-after-free in xfrm async resumption 2026-06-12 08:39:59 +02:00
xfrm6_output.c ipv6: adopt skb_dst_dev() and skb_dst_dev_net[_rcu]() helpers 2025-07-02 14:32:30 -07:00
xfrm6_policy.c xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() 2026-07-06 08:29:08 +02:00
xfrm6_protocol.c ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() 2026-04-17 10:40:29 +02:00
xfrm6_state.c
xfrm6_tunnel.c xfrm: flush all states in xfrm_state_fini 2025-08-06 09:23:38 +02:00