Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <56da57f3-446c-fe63-b625-931fd9f0cbd5@virtuozzo.com>
Date:   Tue, 1 Nov 2022 13:40:21 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.2.2
Subject: Re: [PATCH net] net, neigh: Fix null-ptr-deref in neigh_table_clear()
Content-Language: en-US
To:     Chen Zhongjin <chenzhongjin@huawei.com>, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org
Cc:     davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
        pabeni@redhat.com, dsahern@kernel.org, daniel@iogearbox.net,
        yangyingliang@huawei.com, stephen@networkplumber.org,
        wangyuweihx@gmail.com, alexander.mikhalitsyn@virtuozzo.com,
        xu.xin16@zte.com.cn
References: <20221101121552.21890-1-chenzhongjin@huawei.com>
From:   "Denis V. Lunev" <den@virtuozzo.com>
In-Reply-To: <20221101121552.21890-1-chenzhongjin@huawei.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?SHdlVWhWTVBLODhGVmhnV2ZCWHNFN2RKeFhiY2ExQU1ZYkpDblJDTE9jYlk2?=
 =?utf-8?B?eFU5VDNxOHhVL2VyQ3dIajcxL0JlUmpKMjJhTFEwK3N2b21tbFpjMEN1T1Zp?=
 =?utf-8?B?MC9pcG1QMkFZeFFrODF3VW1nL2s5bUZBWGxjTEdKSW9zaW9hU0ZhYk9DMldU?=
 =?utf-8?B?N3QvaWFMdlh6dmMvY1dlUWZNVzIzTENrbU1LSmRYUmc0NG1vZlIyOTFnMGdi?=
 =?utf-8?B?aTBybXNFNXljQk1BMDNBczlocERFdnYzaWVtd0pYUHdkNGJlOFQyTkhuVXR4?=
 =?utf-8?B?blpBUW5Mb0tSN2FyNkF6L21SdmN0UnVPWkRnR3kzdmJtR3diZjVCTStuUkht?=
 =?utf-8?B?NWpNcFYzQ243ZkR1NHV0ekJyano3R0x1TWdZMU1JK0RRMHBUZnJYanc1M2Z6?=
 =?utf-8?B?L0JZeENXZVV6alUwK3J1TEQxdCtaczdxOXV5RmhQRzMzemREQWs1YTlUQzJy?=
 =?utf-8?B?MjRjbnRyZ1kxbkVhc0hQR0MwUmZNb3oyN0h1R05CQ25tVWVRMkljSm1Qb3Zp?=
 =?utf-8?B?UUMyTjhvTlZNMDFHdHZDaEs1MitYZk5scFlxaTdlWGlOVUtjMlVDckZhNmQ5?=
 =?utf-8?B?K3pRUTV3V1BKWEIrSi84SWRIdUI1bEE0Zys4NHA4eTZkTTY1K0ZDMjd6TTc0?=
 =?utf-8?B?UURxOFZTcHo2TTFyQnh6a0VDVitFVlU5SXpybmRpZjJFVW52OENUcVAra0N4?=
 =?utf-8?B?ZmwzbjlLS3ZQc3Y4a0kxbjFHV0tYd2xaVk5HVWVWcDRncTgrUHhndUV6SldQ?=
 =?utf-8?B?My9xQzNtNXQzVjFZUS9WRGZvSGdSTHNOVjVrSkJ3RWJ5Z2ptTnNZMGNCSDJj?=
 =?utf-8?B?Zm1zRXRLdXhUYktBZjJESlE1Mi9EdmRzbEV3cjJrQlkxY3QzL0ozWDRmcGZi?=
 =?utf-8?B?QTZYR3M4SWpkQUl3RzI0c2YvRTk2aUJucmNObjh6eHBmZ0t2VUxmZUJRc1Ba?=
 =?utf-8?B?emJwK094eWh6NjBDZnQ3NWY2SXpDeUVYZTZuMEhMOG5hMnFTN1JEN3NrbWpH?=
 =?utf-8?B?aDRrSElYTVcxZVdiU1YyVCtqbTB2amJxc21Lc0lvTHFxb0xaVDJmRzM1b3Jk?=
 =?utf-8?B?Q3lQekxVMVYrckZXNUxPOHphd2NpY2UrQ0xlNkU2bzE4ZGlaQzg5SWVXMUtk?=
 =?utf-8?B?LzUyOEtuT2RqZUZiQmRNR24zSHlraDNSeStuN0tqdXRiSi9ybE84ZlpBeVBT?=
 =?utf-8?B?M2ZtckpKT1N2c2lMRXc5UUxqc3hza1lLNys0RGxmZXdEd0g3TlltYmV1MTkw?=
 =?utf-8?B?WVJoNjUwWUd4QU4wOWpDYzBBSGJnNkorUFdqVzdwMzRlM2hua0t0eXZMOG1L?=
 =?utf-8?B?eW9vY2pOckNOWXIzblo5cVU4Zk9KT0dQcEhmUFFnNnErQnRGN3hIYjNNdkhh?=
 =?utf-8?B?cVdpcjF1em5GTEhnTzVtVWlnUXgyQ1pBb3MxdlNXMGttTXVFVFhzS0NkOXZ1?=
 =?utf-8?B?NlVmRHplOXRveTI5WEJhQndHbmlWL1Ara0ppM3VlcWNLTS92cE1nYVlHTDdz?=
 =?utf-8?B?anhub2dWN2diVVBYMVdyeWFUVGpZbmJhMlIrVHVNVTc5aVlYZG10emtFVkhZ?=
 =?utf-8?B?UHFIcVJ6NTJyWWhnd2hSRERiLytMbUk4NGluTjNOdW55UFpLMjhqQmFRTzVh?=
 =?utf-8?B?U1RadlYxeWdiUS83S1huM3VpVGFnc0lXVmdKRmNFTEFuTm84N2RNazB4Zktk?=
 =?utf-8?B?MGd0V1pDeGphWHpLeEVoc0s5bndmTTV4Q3VCeWNKcjlxY1d1STJQNzQxMHhJ?=
 =?utf-8?B?Z1FaV2p5NFczR0Zyb1VMck12eXVFR0QrU0lTTjNEdHFRbWlDM0F4MHhadDJi?=
 =?utf-8?B?czZ2UnhJRjA1dGRZRkZHNTNBci9rTDlpSkdLdlZiR0RkQ2JyZ3hyQnZmczFs?=
 =?utf-8?B?UXd4ZXBXTHNMNlB5aG9WZjhuVmZCVEVkVEFMYVRPSkRBUkRIaFBmcERFampV?=
 =?utf-8?B?NEI1d1QvTWVpeHZTdWFNMXF4K1FBY0NDQTQ2cWNFZS9HMTE2VVU3ZTZnUnVo?=
 =?utf-8?B?N05BdDZnM3l1WFBmVHlwWmJ4VzNYUVpkUTgzQXNVdmkycWlzOURxalZEK29x?=
 =?utf-8?B?empUU2tuU2szcTRQdHM3OW1waUhFUG5DbWZUdXk0a01PMnMxbXo1ZnkvSEM3?=
 =?utf-8?Q?L8XABTIgLx0isn2B3D1dTA7cZ?=
X-OriginatorOrg: virtuozzo.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 9c175629-71a7-4f17-f3e8-08dabc063f26
X-MS-Exchange-CrossTenant-AuthSource: PAXPR08MB6956.eurprd08.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Nov 2022 12:40:24.2783
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: s5L2+5qXQWFJ96F/iS8V5XYmHg5B+Mw+1vBAuxFXm607dRievc5h3rS7KX+L7gfZ0VjUb6OAzAy5OYDhL0tFZg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR08MB9659
X-Spam-Status: No, score=-1.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,NICE_REPLY_A,
        RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_NONE
        autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 11/1/22 13:15, Chen Zhongjin wrote:
> When IPv6 module gets initialized but hits an error in the middle,
> kenel panic with:
>
> KASAN: null-ptr-deref in range [0x0000000000000598-0x000000000000059f]
> CPU: 1 PID: 361 Comm: insmod
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
> RIP: 0010:__neigh_ifdown.isra.0+0x24b/0x370
> RSP: 0018:ffff888012677908 EFLAGS: 00000202
> ...
> Call Trace:
>   <TASK>
>   neigh_table_clear+0x94/0x2d0
>   ndisc_cleanup+0x27/0x40 [ipv6]
>   inet6_init+0x21c/0x2cb [ipv6]
>   do_one_initcall+0xd3/0x4d0
>   do_init_module+0x1ae/0x670
> ...
> Kernel panic - not syncing: Fatal exception
>
> When ipv6 initialization fails, it will try to cleanup and calls:
>
> neigh_table_clear()
>    neigh_ifdown(tbl, NULL)
>      pneigh_queue_purge(&tbl->proxy_queue, dev_net(dev == NULL))
>      # dev_net(NULL) triggers null-ptr-deref.
>
> Fix it by passing NULL to pneigh_queue_purge() in neigh_ifdown() if dev
> is NULL, to make kernel not panic immediately.
>
> Fixes: 66ba215cb513 ("neigh: fix possible DoS due to net iface start/stop loop")
> Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
> ---
>   net/core/neighbour.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/core/neighbour.c b/net/core/neighbour.c
> index 3c4786b99907..a77a85e357e0 100644
> --- a/net/core/neighbour.c
> +++ b/net/core/neighbour.c
> @@ -409,7 +409,7 @@ static int __neigh_ifdown(struct neigh_table *tbl, struct net_device *dev,
>   	write_lock_bh(&tbl->lock);
>   	neigh_flush_dev(tbl, dev, skip_perm);
>   	pneigh_ifdown_and_unlock(tbl, dev);
> -	pneigh_queue_purge(&tbl->proxy_queue, dev_net(dev));
> +	pneigh_queue_purge(&tbl->proxy_queue, dev ? dev_net(dev) : NULL);
>   	if (skb_queue_empty_lockless(&tbl->proxy_queue))
>   		del_timer_sync(&tbl->proxy_timer);
>   	return 0;
Reviewed-by: Denis V. Lunev <den@openvz.org>