[Bug] "WARNING in corrupted" in Linux Kernel v6.15-rc5

[Bug] "WARNING in corrupted" in Linux Kernel v6.15-rc5

[John]

Dear Linux Kernel Maintainers,

I hope this message finds you well.

I am writing to report a potential vulnerability I encountered during
testing of the Linux Kernel version v6.15-rc5.

Git Commit: 92a09c47464d040866cf2b4cd052bc60555185fb (tag: v6.15-rc5)

Bug Location: 20628 at net/ipv4/ipmr.c:440 ipmr_free_table
net/ipv4/ipmr.c:440 [inline]

Bug report: https://hastebin.com/share/idudaveten.yaml

Complete log: https://hastebin.com/share/ojonatucos.perl

Entire kernel config:  https://hastebin.com/share/padecilimo.ini

Root Cause Analysis:
A kernel warning is triggered during the execution of
ipmr_rules_exit() at line 440 of net/ipv4/ipmr.c, when attempting to
free a multicast routing (mr) table that may have already been
released or was never correctly initialized.
This function is called as part of the ipmr_net_exit_batch() logic
when a network namespace is being torn down (copy_net_ns() →
create_new_namespaces() → unshare() syscall).
The crash is accompanied by a FAULT_INJECTION trace involving
copy_from_user_iter, suggesting this might be a fuzzing-induced fault
where the data passed via netlink_sendmsg() is malformed.
However, the primary issue lies in ipmr_free_table() dereferencing a
potentially invalid pointer—either due to a race condition during
namespace teardown or improper error handling during netns
initialization.

At present, I have not yet obtained a minimal reproducer for this
issue. However, I am actively working on reproducing it, and I will
promptly share any additional findings or a working reproducer as soon
as it becomes available.

Thank you very much for your time and attention to this matter. I
truly appreciate the efforts of the Linux kernel community.

Best regards,
John

Re: [Bug] "WARNING in corrupted" in Linux Kernel v6.15-rc5

[Paolo Abeni]

On 5/26/25 9:11 AM, John wrote:
> I am writing to report a potential vulnerability I encountered during
> testing of the Linux Kernel version v6.15-rc5.
> 
> Git Commit: 92a09c47464d040866cf2b4cd052bc60555185fb (tag: v6.15-rc5)
> 
> Bug Location: 20628 at net/ipv4/ipmr.c:440 ipmr_free_table
> net/ipv4/ipmr.c:440 [inline]
> 
> Bug report: https://hastebin.com/share/idudaveten.yaml
> 
> Complete log: https://hastebin.com/share/ojonatucos.perl
> 
> Entire kernel config:  https://hastebin.com/share/padecilimo.ini
> 
> Root Cause Analysis:
> A kernel warning is triggered during the execution of
> ipmr_rules_exit() at line 440 of net/ipv4/ipmr.c, when attempting to
> free a multicast routing (mr) table that may have already been
> released or was never correctly initialized.
> This function is called as part of the ipmr_net_exit_batch() logic
> when a network namespace is being torn down (copy_net_ns() →
> create_new_namespaces() → unshare() syscall).
> The crash is accompanied by a FAULT_INJECTION trace involving
> copy_from_user_iter, suggesting this might be a fuzzing-induced fault
> where the data passed via netlink_sendmsg() is malformed.
> However, the primary issue lies in ipmr_free_table() dereferencing a
> potentially invalid pointer—either due to a race condition during
> namespace teardown or improper error handling during netns
> initialization.
> 
> At present, I have not yet obtained a minimal reproducer for this
> issue. However, I am actively working on reproducing it, and I will
> promptly share any additional findings or a working reproducer as soon
> as it becomes available.
> 
> Thank you very much for your time and attention to this matter. I
> truly appreciate the efforts of the Linux kernel community.

Should be fixed by commit c46286fdd6aa, which landed in 6.15

/P