From: Kuniyuki Iwashima <kuniyu@amazon.com>
To: <guohui.study@gmail.com>
Cc: <davem@davemloft.net>, <dsahern@kernel.org>,
<edumazet@google.com>, <horms@kernel.org>, <kuba@kernel.org>,
<kuniyu@amazon.com>, <linux-kernel@vger.kernel.org>,
<netdev@vger.kernel.org>, <pabeni@redhat.com>,
<syzkaller-bugs@googlegroups.com>, <willemb@google.com>
Subject: Re: general protection fault in addrconf_add_ifaddr
Date: Sat, 5 Apr 2025 20:28:06 -0700 [thread overview]
Message-ID: <20250406032819.65634-1-kuniyu@amazon.com> (raw)
In-Reply-To: <CAHOo4gK+tdU1B14Kh6tg-tNPqnQ1qGLfinONFVC43vmgEPnXXw@mail.gmail.com>
From: Hui Guo <guohui.study@gmail.com>
Date: Sun, 6 Apr 2025 10:31:00 +0800
> Hi Kernel Maintainers,
> we found a crash "general protection fault in addrconf_add_ifaddr" (it
> is a KASAN and makes the kernel reboot) in upstream, we also have
> successfully reproduced it manually:
>
> HEAD Commit: 9f867ba24d3665d9ac9d9ef1f51844eb4479b291
> kernel config: https://raw.githubusercontent.com/androidAppGuard/KernelBugs/refs/heads/main/9f867ba24d3665d9ac9d9ef1f51844eb4479b291/.config
>
> console output:
> https://raw.githubusercontent.com/androidAppGuard/KernelBugs/refs/heads/main/9f867ba24d3665d9ac9d9ef1f51844eb4479b291/b4f94e7f408c53ff0bac07a7b69ecfe48ab5575d/repro.log
> repro report: https://raw.githubusercontent.com/androidAppGuard/KernelBugs/refs/heads/main/9f867ba24d3665d9ac9d9ef1f51844eb4479b291/b4f94e7f408c53ff0bac07a7b69ecfe48ab5575d/repro.report
> syz reproducer:
> https://raw.githubusercontent.com/androidAppGuard/KernelBugs/refs/heads/main/9f867ba24d3665d9ac9d9ef1f51844eb4479b291/b4f94e7f408c53ff0bac07a7b69ecfe48ab5575d/repro.prog
> c reproducer: https://raw.githubusercontent.com/androidAppGuard/KernelBugs/refs/heads/main/9f867ba24d3665d9ac9d9ef1f51844eb4479b291/b4f94e7f408c53ff0bac07a7b69ecfe48ab5575d/repro.cprog
>
> Please let me know if there is anything I can help with.
> Best,
> Hui Guo
>
> This is the crash log I got by reproducing the bug based on the above
> environment，
> I have piped this log through decode_stacktrace.sh to better
> understand the cause of the bug.
[...]
> [ 90.201985][T12032] Oops: general protection fault, probably for
> non-canonical address 0xdffffc0000000198: 0000 [#1] SMP KASAN NOPTI
> [ 90.204525][T12032] KASAN: null-ptr-deref in range
> [0x0000000000000cc0-0x0000000000000cc7]
> [ 90.206275][T12032] CPU: 3 UID: 0 PID: 12032 Comm: syz.0.15 Not
> tainted 6.14.0-13408-g9f867ba24d36 #1 PREEMPT(full)
> [ 90.208522][T12032] Hardware name: QEMU Standard PC (i440FX + PIIX,
> 1996), BIOS 1.15.0-1 04/01/2014
> [90.210452][T12032] RIP: 0010:addrconf_add_ifaddr
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./include/net/netdev_lock.h:30
> /data/ghui/docker_data/linux_kernel/upstream/linux/./include/net/netdev_lock.h:41
> /data/ghui/docker_data/linux_kernel/upstream/linux/net/ipv6/addrconf.c:3157)
Thanks for the report.
netdev_lock_ops() needs to be moved:
---8<---
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index c3b908fccbc1..9c52ed23ff23 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3154,12 +3154,13 @@ int addrconf_add_ifaddr(struct net *net, void __user *arg)
rtnl_net_lock(net);
dev = __dev_get_by_index(net, ireq.ifr6_ifindex);
- netdev_lock_ops(dev);
- if (dev)
+ if (dev) {
+ netdev_lock_ops(dev);
err = inet6_addr_add(net, dev, &cfg, 0, 0, NULL);
- else
+ netdev_unlock_ops(dev);
+ } else {
err = -ENODEV;
- netdev_unlock_ops(dev);
+ }
rtnl_net_unlock(net);
return err;
}
---8<---
prev parent reply other threads:[~2025-04-06 3:28 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-04-06 2:31 Hui Guo
2025-04-06 3:28 ` Kuniyuki Iwashima [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250406032819.65634-1-kuniyu@amazon.com \
--to=kuniyu@amazon.com \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=guohui.study@gmail.com \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=willemb@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®