From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail78-36.sinamail.sina.com.cn (mail78-36.sinamail.sina.com.cn [219.142.78.36]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 29CA922B8B8 for ; Wed, 5 Feb 2025 12:08:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=219.142.78.36 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738757344; cv=none; b=rJmEMWh2GqiNDMqGAYW5narwnY09M912FNltuoE4MI7PSR/RTMhLIXYwhwtRbB0I22OIUJT6CHMONU9MKvGThP/0rGbsx21rNYvitkY60/o5VJW79uR7vtVmd8FP1/eF3mBq8/RmvKVOgHSH4S2wgWN22k/NvWksCeYd3vZv+O4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738757344; c=relaxed/simple; bh=oUwvX+uOb3xbRTu7xJ24WvLsk4TWa4T1nP0vhd3iVUY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=Y1fR0Fh+8eBQh0wkPoPJ6i/pGVxvqPW6hFQC8geM5Nfsgz69V1xC5Z6AsNkfvtRQk0BmMtmD4GgKOnes2KK0pzi4wM4nxJh8gsEk7TXQ2sguUvLFCIYR/W9kuX+17QqSOc+ur4v2XtdwGBRZLKQRnirKfN2cy3HVY/qC77iIZFU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=sina.com; spf=pass smtp.mailfrom=sina.com; arc=none smtp.client-ip=219.142.78.36 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=sina.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=sina.com X-SMAIL-HELO: localhost.localdomain Received: from unknown (HELO localhost.localdomain)([113.88.48.12]) by sina.com (10.185.250.24) with ESMTP id 67A34C8C00000DC7; Wed, 5 Feb 2025 19:33:36 +0800 (CST) X-Sender: hdanton@sina.com X-Auth-ID: hdanton@sina.com Authentication-Results: sina.com; spf=none smtp.mailfrom=hdanton@sina.com; dkim=none header.i=none; dmarc=none action=none header.from=hdanton@sina.com X-SMAIL-MID: 35320310748441 X-SMAIL-UIID: D470E7C931B4486BB415BBDC3338ED6A-20250205-193336-1 From: Hillf Danton To: Eric Dumazet Cc: YAN KANG , netdev , LKML Subject: Re: general protection fault in ip6_pol_route Date: Wed, 5 Feb 2025 19:33:31 +0800 Message-ID: <20250205113334.1960-1-hdanton@sina.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On Tue, 4 Feb 2025 15:07:49 +0100 Eric Dumazet > On Tue, Feb 4, 2025 at 2:47 PM YAN KANG wrote: > > > > Dear maintainers, > > > > I found a kernel bug titiled "general protection fault in ip6_pol_route" while using modified syzkaller fuzzing tool. I Itested it on the latest Linux upstream version (6.13.0-rc7) . > > > > > > After preliminary analysis, the rootcause may be in ip6_pol_route function net/ipv6/route.c > > res is a stack object. [1] > > fib6_select_path(net, &res, fl6, oif, false, skb, strict) call may initialize res->nh.[2] > > rt = rt6_get_pcpu_route( &res); [3] > > pcpu_rt = this_cpu_read(*res->nh->rt6i_pcpu); // *res->nh is NULL, crash > > > > in [2], res->nh can be initialized in several ways,possibly one of which initializes it to NULL. > > > > Unfortunately, I don't have any reproducer for this bug yet. > > > > If you fix this issue, please add the following tag to the commit: > > Reported-by: yan kang > > Reported-by: yue sun > > This is a dup of a syzbot report under investigation. > > Unless you have a repro and/or a patch, I would recommend you not > sending these fuzzer reports anymore. > > Releasing such reports without a fix is an obvious security risk. > Can you specify a bit why report like this one links to security risk, Eric, given no fix yet delivered to the syzbot report [1] so far? [1] https://yhbt.net/lore/lkml/67a21f26.050a0220.163cdc.0068.GAE@google.com/