syzbot reported a null-ptr-deref in __ip6_del_rt_siblings() [0]. The stack trace hinted towards a null dereference of rt->fib6_node when fn->leaf is accessed in __ip6_del_rt_siblings(). With RTNL_FLAG_DOIT_UNLOCKED set, inet6_rtm_delroute() operations run concurrently without acquiring the RTNL lock. In ip6_route_del(), the route lookup happens under rcu_read_lock() without acquiring table->tb6_lock. Between ip6_route_del() looking up the route and __ip6_del_rt_siblings() acquiring table->tb6_lock, another thread can modify the routing table. For example, when an ECMP route is replaced via RTM_NEWROUTE with NLM_F_REPLACE, fib6_add_rt2node() unlinks all old siblings and sets iter->fib6_node = NULL. A reproducer was found that triggers this [1]. Add a check to ensure rt->fib6_node is non-null before accessing it. [0] KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:__ip6_del_rt_siblings+0x31e/0x7c0 net/ipv6/route.c:4056 Call Trace: <TASK> ip6_route_del+0x1054/0x1110 net/ipv6/route.c:4232 inet6_rtm_delroute+0x5d7/0x6d0 net/ipv6/route.c:5669 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7132 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800 __sock_sendmsg net/socket.c:815 [inline] ____sys_sendmsg+0x565/0x870 net/socket.c:2713 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2767 __sys_sendmsg net/socket.c:2799 [inline] __do_sys_sendmsg net/socket.c:2804 [inline] __se_sys_sendmsg net/socket.c:2802 [inline] __x64_sys_sendmsg+0x1b7/0x290 net/socket.c:2802 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> [1] https://gist.github.com/NamanGulati/0766a1159b6ca61928faaf87425ff899
Unified · Split
| @@ -4019,6 +4019,7 @@ static int __ip6_del_rt_siblings(struct fib6_info *rt, struct fib6_config *cfg) · 4018 unmodified lines | ||
| 4019 | 4019 | struct net *net = info->nl_net; |
| 4020 | 4020 | struct sk_buff *skb = NULL; |
| 4021 | 4021 | struct fib6_table *table; |
| 4022 | + struct fib6_node *fn; | |
| 4022 | 4023 | int err = -ENOENT; |
| 4023 | 4024 | |
| 4024 | 4025 | if (rt == net->ipv6.fib6_null_entry) |
| @@ -4026,9 +4027,13 @@ static int __ip6_del_rt_siblings(struct fib6_info *rt, struct fib6_config *cfg) · 1 unmodified line | ||
| 4026 | 4027 | table = rt->fib6_table; |
| 4027 | 4028 | spin_lock_bh(&table->tb6_lock); |
| 4028 | 4029 | |
| 4030 | + fn = rcu_dereference_protected(rt->fib6_node, | |
| 4031 | + lockdep_is_held(&table->tb6_lock)); | |
| 4032 | + if (!fn) | |
| 4033 | + goto out_unlock; | |
| 4034 | + | |
| 4029 | 4035 | if (rt->fib6_nsiblings && cfg->fc_delete_all_nh) { |
| 4030 | 4036 | struct fib6_info *sibling, *next_sibling; |
| 4031 | − struct fib6_node *fn; | |
| 4032 | 4037 | |
| 4033 | 4038 | /* prefer to send a single notification with all hops */ |
| 4034 | 4039 | skb = nlmsg_new(rt6_nlmsg_size(rt), GFP_ATOMIC); |
| @@ -4051,8 +4056,6 @@ static int __ip6_del_rt_siblings(struct fib6_info *rt, struct fib6_config *cfg) · 16 unmodified lines | ||
| 4051 | 4056 | * and emit a replace or delete notification, respectively. |
| 4052 | 4057 | */ |
| 4053 | 4058 | info->skip_notify_kernel = 1; |
| 4054 | − fn = rcu_dereference_protected(rt->fib6_node, | |
| 4055 | − lockdep_is_held(&table->tb6_lock)); | |
| 4056 | 4059 | if (rcu_access_pointer(fn->leaf) == rt) { |
| 4057 | 4060 | struct fib6_info *last_sibling, *replace_rt; |
| 4058 | 4061 | |