On 05/21/2018 08:51 PM, Eric Dumazet wrote:
> commit 8fb472c09b9d ("ipmr: improve hash scalability")
> added a call to rhltable_init() without checking its return value.
>
> This problem was then later copied to IPv6 and factorized in commit
> 0bbbf0e7d0e7 ("ipmr, ip6mr: Unite creation of new mr_table")
>
> kasan: CONFIG_KASAN_INLINE enabled
> kasan: GPF could be caused by NULL-ptr deref or user memory access
> general protection fault: 0000 [#1] SMP KASAN
> Dumping ftrace buffer:
> (ftrace buffer empty)
> Modules linked in:
> CPU: 1 PID: 31552 Comm: syz-executor7 Not tainted 4.17.0-rc5+ #60
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> RIP: 0010:rht_key_hashfn include/linux/rhashtable.h:277 [inline]
> RIP: 0010:__rhashtable_lookup include/linux/rhashtable.h:630 [inline]
> RIP: 0010:rhltable_lookup include/linux/rhashtable.h:716 [inline]
> RIP: 0010:mr_mfc_find_parent+0x2ad/0xbb0 net/ipv4/ipmr_base.c:63
> RSP: 0018:ffff8801826aef70 EFLAGS: 00010203
> RAX: 0000000000000001 RBX: 0000000000000001 RCX: ffffc90001ea0000
> RDX: 0000000000000079 RSI: ffffffff8661e859 RDI: 000000000000000c
> RBP: ffff8801826af1c0 R08: ffff8801b2212000 R09: ffffed003b5e46c2
> R10: ffffed003b5e46c2 R11: ffff8801daf23613 R12: dffffc0000000000
> R13: ffff8801826af198 R14: ffff8801cf8225c0 R15: ffff8801826af658
> FS: 00007ff7fa732700(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00000003ffffff9c CR3: 00000001b0210000 CR4: 00000000001406e0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> ip6mr_cache_find_parent net/ipv6/ip6mr.c:981 [inline]
> ip6mr_mfc_delete+0x1fe/0x6b0 net/ipv6/ip6mr.c:1221
> ip6_mroute_setsockopt+0x15c6/0x1d70 net/ipv6/ip6mr.c:1698
> do_ipv6_setsockopt.isra.9+0x422/0x4660 net/ipv6/ipv6_sockglue.c:163
> ipv6_setsockopt+0xbd/0x170 net/ipv6/ipv6_sockglue.c:922
> rawv6_setsockopt+0x59/0x140 net/ipv6/raw.c:1060
> sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3039
> __sys_setsockopt+0x1bd/0x390 net/socket.c:1903
> __do_sys_setsockopt net/socket.c:1914 [inline]
> __se_sys_setsockopt net/socket.c:1911 [inline]
> __x64_sys_setsockopt+0xbe/0x150 net/socket.c:1911
> do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
>
> Fixes: 8fb472c09b9d ("ipmr: improve hash scalability")
> Fixes: 0bbbf0e7d0e7 ("ipmr, ip6mr: Unite creation of new mr_table")
> Signed-off-by: Eric Dumazet <eduma...@google.com>
> Cc: Nikolay Aleksandrov <niko...@cumulusnetworks.com>
> Cc: Yuval Mintz <yuv...@mellanox.com>
> Reported-by: syzbot <syzkal...@googlegroups.com>
> ---
> net/ipv4/ipmr_base.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
Oops :). Thanks!
Acked-by: Nikolay Aleksandrov <niko...@cumulusnetworks.com>
