github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-14 16:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
8d75c338f0
linux/net/ipv6
History
Pengfei Zhang 9facb861dc ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump 
inet6_dump_fib() saves its progress in cb->args[1] as a positional
index within the current hash chain.  Between batches, a concurrent
fib6_new_table() can insert a new table at the chain head, shifting
all existing entries.  The saved index then lands on a different
table, causing fib6_dump_table() to set w->root to the wrong table
while w->node still points into the previous one.
fib6_walk_continue() dereferences w->node->parent (NULL) and panics:

  BUG: kernel NULL pointer dereference, address: 0000000000000008
  RIP: 0010:fib6_walk_continue+0x6e/0x170
  Call Trace:
   <TASK>
   fib6_dump_table.isra.0+0xc5/0x240
   inet6_dump_fib+0xf6/0x420
   rtnl_dumpit+0x30/0xa0
   netlink_dump+0x15b/0x460
   netlink_recvmsg+0x1d6/0x2a0
   ____sys_recvmsg+0x17a/0x190

Fix by storing tb->tb6_id in cb->args[1] instead of a positional
index.  On resume, skip entries until the id matches; a concurrent
head-insert can never match the saved id, so the walker always
resumes on the correct table.

Fixes: 1b43af5480 ("[IPV6]: Increase number of possible routing tables to 2^32")
Signed-off-by: Pengfei Zhang <zhangfeionline@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260625070517.965597-1-zhangfeionline@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-29 18:28:41 -07:00
..
ila net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
netfilter Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-06-11 14:33:35 -07:00
addrconf_core.c ipv6: remove obsolete EXPORT_SYMBOL() and EXPORT_SYMBOL_GPL() 2026-06-05 17:47:42 -07:00
addrconf.c ipv6: fix missing notification for ignore_routes_with_linkdown 2026-06-23 19:12:48 -07:00
addrlabel.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
af_inet6.c tcp: rehash onto different local ECMP path on retransmit timeout 2026-06-15 15:57:31 -07:00
ah6.c xfrm: ah: use skb_to_full_sk in async output callbacks 2026-05-16 10:56:14 +02:00
anycast.c ipv6: anycast: insert aca into global hash under idev->lock 2026-06-02 19:30:39 -07:00
calipso.c Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
datagram.c ipv6: validate extension header length before copying to cmsg 2026-05-26 18:53:10 -07:00
esp6_offload.c xfrm: Fix inner mode lookup in tunnel mode GSO segmentation 2025-12-04 09:54:53 +01:00
esp6.c esp: fix page frag reference leak on skb_to_sgvec failure 2026-06-09 15:58:17 +02:00
exthdrs_core.c ipv6: Implement limits on extension header parsing 2026-04-30 17:21:45 -07:00
exthdrs_offload.c
exthdrs.c ipv6: exthdrs: recompute network header pointer once 2026-06-03 19:14:56 -07:00
fib6_notifier.c net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
fib6_rules.c ipv6: export fib6_lookup for nft_fib_ipv6 2026-03-04 11:45:44 +01:00
fou6.c fou: Remove IPPROTO_UDPLITE check in gue_err() and gue6_err(). 2026-03-17 16:10:59 -07:00
icmp.c ipv6: fix possible UAF in icmpv6_rcv() 2026-04-18 12:09:52 -07:00
inet6_connection_sock.c tcp: rehash onto different local ECMP path on retransmit timeout 2026-06-15 15:57:31 -07:00
inet6_hashtables.c tcp: use __jhash_final() in inet6_ehashfn() 2026-03-29 11:45:48 -07:00
ioam6_iptunnel.c ipv6: ioam: fix type confusion of dst_entry 2026-06-21 15:26:40 -07:00
ioam6.c net: ioam6: no longer acquire qdisc spinlock while calling qdisc_qstats_qlen_backlog() 2026-05-14 17:05:20 -07:00
ip6_checksum.c udp: Remove UDPLITE_SEND_CSCOV and UDPLITE_RECV_CSCOV. 2026-03-13 18:57:45 -07:00
ip6_fib.c ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump 2026-06-29 18:28:41 -07:00
ip6_flowlabel.c ipv6: use READ_ONCE() in ipv6_flowlabel_get() 2026-06-04 18:31:18 -07:00
ip6_gre.c net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink 2026-06-17 16:01:52 -07:00
ip6_icmp.c ipv6: remove dynamic ICMPv6 sender registration infrastructure 2026-03-29 11:21:23 -07:00
ip6_input.c ipv6: Implement limits on extension header parsing 2026-04-30 17:21:45 -07:00
ip6_offload.c net: pppoe: implement GRO/GSO support 2026-05-19 09:47:53 +02:00
ip6_offload.h
ip6_output.c ipv6: account for fraggap on the paged allocation path 2026-06-21 15:24:49 -07:00
ip6_tunnel.c netfilter: flowtable: fix and simplify IP6IP6 tunnel handling 2026-06-19 12:22:29 +02:00
ip6_udp_tunnel.c udp_tunnel: Pass struct sock to udp_tunnel6_dst_lookup(). 2026-05-05 17:47:04 -07:00
ip6_vti.c net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink 2026-06-17 16:01:52 -07:00
ip6mr.c ipmr: Convert mr_table.cache_resolve_queue_len to u32. 2026-06-11 15:17:30 -07:00
ipcomp6.c xfrm: add extack to xfrm_init_state 2026-06-04 12:22:35 +02:00
ipv6_sockglue.c ipv6: Remove UDP-Lite support for IPV6_ADDRFORM. 2026-03-13 18:57:44 -07:00
Kconfig ipv6: default IPV6_SIT to m 2026-05-05 17:31:51 -07:00
Makefile netfilter: add option for GCOV profiling 2026-05-24 22:55:47 +02:00
mcast_snoop.c
mcast.c ipv6: mcast: annotate igmp6 timer expiry race 2026-06-12 17:12:08 -07:00
mip6.c
ndisc.c ipv6: ndisc: fix NULL deref in accept_untracked_na() 2026-06-21 15:13:24 -07:00
netfilter.c netfilter: remove nf_ipv6_ops and use direct function calls 2026-03-29 11:21:24 -07:00
output_core.c ipv6: remove obsolete EXPORT_SYMBOL() and EXPORT_SYMBOL_GPL() 2026-06-05 17:47:42 -07:00
ping.c net: remove addr_len argument of recvmsg() handlers 2026-03-02 18:17:17 -08:00
proc.c udp: Remove UDP-Lite SNMP stats. 2026-03-13 18:57:44 -07:00
protocol.c
raw.c net: change sock_queue_rcv_skb_reason() to return a drop_reason 2026-04-12 14:30:25 -07:00
reassembly.c ipv6: frags: cleanup __IP6_INC_STATS() confusion 2026-05-27 17:27:26 -07:00
route.c ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). 2026-06-22 18:20:09 -07:00
rpl_iptunnel.c net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels 2026-04-28 11:16:14 +02:00
rpl.c
seg6_hmac.c ipv6: add NULL checks for idev in SRv6 paths 2026-03-18 17:23:43 -07:00
seg6_iptunnel.c net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels 2026-04-28 11:16:14 +02:00
seg6_local.c ipv6: adopt dst_dev() helper 2025-07-02 14:32:30 -07:00
seg6.c seg6: validate SRH length before reading fixed fields 2026-06-26 18:49:37 -07:00
sit.c net: sit: require CAP_NET_ADMIN in the device netns for changelink 2026-06-21 15:10:06 -07:00
syncookies.c tcp: rehash onto different local ECMP path on retransmit timeout 2026-06-15 15:57:31 -07:00
sysctl_net_ipv6.c
tcp_ao.c net/tcp-ao: Return void from functions that can no longer fail 2026-04-30 09:38:56 +02:00
tcp_ipv6.c tcp: rehash onto different local ECMP path on retransmit timeout 2026-06-15 15:57:31 -07:00
tcpv6_offload.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-01-29 17:28:54 -08:00
tunnel6.c
udp_offload.c udp: Don't pass udptable to IPv6 socket lookup functions. 2026-03-13 18:57:46 -07:00
udp.c udp: Force compute_score to always inline 2026-04-13 15:44:42 -07:00
xfrm6_input.c xfrm: Fix dev use-after-free in xfrm async resumption 2026-06-12 08:39:59 +02:00
xfrm6_output.c ipv6: adopt skb_dst_dev() and skb_dst_dev_net[_rcu]() helpers 2025-07-02 14:32:30 -07:00
xfrm6_policy.c xfrm6: fix uninitialized saddr in xfrm6_get_saddr() 2026-02-02 08:03:47 +01:00
xfrm6_protocol.c ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() 2026-04-17 10:40:29 +02:00
xfrm6_state.c
xfrm6_tunnel.c xfrm: flush all states in xfrm_state_fini 2025-08-06 09:23:38 +02:00