kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/net/ipv4
History
Kuniyuki Iwashima 0d8556922d ipv4: fib: Annotate access to struct fib_alias.fa_state. 
[ Upstream commit 6e84fc395e ]

syzbot reported that struct fib_alias.fa_state can be
modified locklessly by RCU readers. [0]

Let's use READ_ONCE()/WRITE_ONCE() properly.

[0]:
BUG: KCSAN: data-race in fib_table_lookup / fib_table_lookup

write to 0xffff88811b06a7fa of 1 bytes by task 4167 on cpu 0:
 fib_alias_accessed net/ipv4/fib_lookup.h:32 [inline]
 fib_table_lookup+0x361/0xd60 net/ipv4/fib_trie.c:1565
 fib_lookup include/net/ip_fib.h:390 [inline]
 ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814
 ip_route_output_key_hash net/ipv4/route.c:2705 [inline]
 __ip_route_output_key include/net/route.h:169 [inline]
 ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932
 udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450
 inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 ____sys_sendmsg+0x53a/0x600 net/socket.c:2592
 ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646
 __sys_sendmmsg+0x185/0x320 net/socket.c:2735
 __do_sys_sendmmsg net/socket.c:2762 [inline]
 __se_sys_sendmmsg net/socket.c:2759 [inline]
 __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759
 x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88811b06a7fa of 1 bytes by task 4168 on cpu 1:
 fib_alias_accessed net/ipv4/fib_lookup.h:31 [inline]
 fib_table_lookup+0x338/0xd60 net/ipv4/fib_trie.c:1565
 fib_lookup include/net/ip_fib.h:390 [inline]
 ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814
 ip_route_output_key_hash net/ipv4/route.c:2705 [inline]
 __ip_route_output_key include/net/route.h:169 [inline]
 ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932
 udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450
 inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 ____sys_sendmsg+0x53a/0x600 net/socket.c:2592
 ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646
 __sys_sendmmsg+0x185/0x320 net/socket.c:2735
 __do_sys_sendmmsg net/socket.c:2762 [inline]
 __se_sys_sendmmsg net/socket.c:2759 [inline]
 __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759
 x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00 -> 0x01

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 4168 Comm: syz.4.206 Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025

Reported-by: syzbot+d24f940f770afda885cf@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/69783ead.050a0220.c9109.0013.GAE@google.com/
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260127043528.514160-1-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-03-04 07:20:10 -05:00
..
bpfilter net: Revert "net: optimize the sockptr_t for unified kernel/user address spaces" 2020-08-10 12:06:44 -07:00
netfilter netfilter: nf_reject: don't reply to icmp error messages 2025-12-07 06:09:21 +09:00
af_inet.c net: inet: do not leave a dangling sk pointer in inet_create() 2024-12-14 19:51:37 +01:00
ah4.c Networking changes for 5.14. 2021-06-30 15:51:09 -07:00
arp.c arp: do not assume dev_hard_header() does not change skb->head 2026-01-19 13:10:17 +01:00
bpf_tcp_ca.c bpf: Forbid bpf_ktime_get_coarse_ns and bpf_timer_* in tracing progs 2021-11-25 09:49:07 +01:00
cipso_ipv4.c cipso: fix total option length computation 2024-07-05 09:14:29 +02:00
datagram.c udp: Update reuse->has_conns under reuseport_lock. 2022-10-29 10:12:56 +02:00
devinet.c ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() 2025-09-09 18:50:19 +02:00
esp4.c espintcp: fix skb leaks 2026-02-06 16:42:03 +01:00
esp4_offload.c xfrm: Linearize the skb after offloading if needed. 2023-06-28 10:29:46 +02:00
fib_frontend.c ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). 2025-06-04 14:37:59 +02:00
fib_lookup.h ipv4: fib: Annotate access to struct fib_alias.fa_state. 2026-03-04 07:20:10 -05:00
fib_notifier.c net: fib_notifier: propagate extack down to the notifier block callback 2019-10-04 11:10:56 -07:00
fib_rules.c ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). 2025-06-04 14:38:03 +02:00
fib_semantics.c net: Add l3mdev index to flow struct and avoid oif reset for port devices 2024-10-17 15:11:57 +02:00
fib_trie.c ipv4: fib: Annotate access to struct fib_alias.fa_state. 2026-03-04 07:20:10 -05:00
fou_core.c net: fou: use policy and operation tables generated from the spec 2026-02-06 16:41:52 +01:00
fou_nl.c fou: Don't allow 0 for FOU_ATTR_IPPROTO. 2026-02-06 16:41:52 +01:00
fou_nl.h net: fou: use policy and operation tables generated from the spec 2026-02-06 16:41:52 +01:00
gre_demux.c net: Remove the member netns_ok 2021-05-17 15:29:35 -07:00
gre_offload.c gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers 2024-09-12 11:07:47 +02:00
icmp.c icmp: fix icmp_ndo_send address translation for reply direction 2025-09-09 18:50:18 +02:00
igmp.c bpf: net: Change do_ip_getsockopt() to take the sockptr_t argument 2024-03-26 18:21:23 -04:00
inet_connection_sock.c tcp: Fix use-after-free of nreq in reqsk_timer_handler(). 2024-12-14 19:51:10 +01:00
inet_diag.c inet_diag: Initialize pad field in struct inet_diag_req_v2 2024-07-18 13:07:31 +02:00
inet_fragment.c inet: inet_defrag: prevent sk release while still in use 2024-10-17 15:10:41 +02:00
inet_hashtables.c inet: Avoid ehash lookup race in inet_ehash_insert() 2026-01-19 13:09:23 +01:00
inet_timewait_sock.c tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge() 2024-05-02 16:24:49 +02:00
inetpeer.c inetpeer: Fix data-races around sysctl. 2022-07-21 21:24:21 +02:00
ip_forward.c ip: Fix data-races around sysctl_ip_fwd_update_priority. 2022-07-29 17:25:13 +02:00
ip_fragment.c inet: inet_defrag: prevent sk release while still in use 2024-10-17 15:10:41 +02:00
ip_gre.c ipv4: ip_gre: make ipgre_header() robust 2026-02-06 16:41:45 +01:00
ip_input.c ipv4: ignore dst hint for multipath routes 2023-09-19 12:22:58 +02:00
ip_options.c net: clean up codestyle for net/ipv4 2020-08-25 06:28:02 -07:00
ip_output.c net: Add locking to protect skb->dev access in ip_output 2026-02-06 16:42:01 +01:00
ip_sockglue.c bpf: net: Change do_ip_getsockopt() to take the sockptr_t argument 2024-03-26 18:21:23 -04:00
ip_tunnel.c net/ip6_tunnel: Prevent perpetual tunnel growth 2025-10-29 14:03:08 +01:00
ip_tunnel_core.c tunnels: reset the GSO metadata before reusing the skb 2025-10-02 13:39:02 +02:00
ip_vti.c ip_vti: fix potential slab-use-after-free in decode_session6 2023-08-26 14:23:32 +02:00
ipcomp.c xfrm: delete x->tunnel as we delete x 2026-01-19 13:09:18 +01:00
ipconfig.c net: ipconfig: Don't override command-line hostnames or domains 2021-06-02 13:27:03 -07:00
ipip.c ip_tunnel: use ndo_siocdevprivate 2021-07-27 20:11:44 +01:00
ipmr.c ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt() function 2024-03-26 18:21:23 -04:00
ipmr_base.c ipmr: do not call mr_mfc_uses_dev() for unres entries 2025-03-13 12:50:11 +01:00
Kconfig tcp: configurable source port perturb table size 2022-12-02 17:41:11 +01:00
Makefile net: fou: use policy and operation tables generated from the spec 2026-02-06 16:41:52 +01:00
metrics.c ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() 2023-02-01 08:27:27 +01:00
netfilter.c netfilter: Dissect flow after packet mangling 2021-04-18 22:04:16 +02:00
netlink.c treewide: Add SPDX license identifier for missed files 2019-05-21 10:50:45 +02:00
nexthop.c net: When removing nexthops, don't call synchronize_net if it is not necessary 2025-12-07 06:09:19 +09:00
ping.c inet: ping: Fix icmp out counting 2026-01-19 13:10:16 +01:00
proc.c minmax: add a few more MIN_T/MAX_T users 2025-10-19 16:21:52 +02:00
protocol.c net: Remove the member netns_ok 2021-05-17 15:29:35 -07:00
raw.c ipv4: Fix uninit-value access in __ip_make_skb() 2026-01-19 13:10:12 +01:00
raw_diag.c net: Use nlmsg_unicast() instead of netlink_unicast() 2021-07-13 09:28:29 -07:00
route.c ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe 2025-12-07 06:09:29 +09:00
syncookies.c tcp: fix cookie_init_timestamp() overflows 2023-11-20 11:08:16 +01:00
sysctl_net_ipv4.c tcp: restrict net.ipv4.tcp_app_win 2023-04-20 12:13:53 +02:00
tcp.c tcp: tcp_tx_timestamp() must look at the rtx queue 2026-03-04 07:19:35 -05:00
tcp_bbr.c tcp: add accessors to read/set tp->snd_cwnd 2022-06-14 18:36:11 +02:00
tcp_bic.c tcp: add accessors to read/set tp->snd_cwnd 2022-06-14 18:36:11 +02:00
tcp_bpf.c tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. 2025-10-02 13:39:00 +02:00
tcp_cdg.c tcp: cdg: allow tcp_cdg_release() to be called multiple times 2022-11-26 09:24:50 +01:00
tcp_cong.c tcp: add accessors to read/set tp->snd_cwnd 2022-06-14 18:36:11 +02:00
tcp_cubic.c tcp_cubic: fix incorrect HyStart round start detection 2025-03-13 12:49:59 +01:00
tcp_dctcp.c tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). 2024-06-16 13:39:47 +02:00
tcp_dctcp.h tcp: refactor DCTCP ECN ACK handling 2018-10-10 22:26:00 -07:00
tcp_diag.c inet_diag: Move the INET_DIAG_REQ_BYTECODE nlattr to cb->data 2020-02-27 18:50:19 -08:00
tcp_fastopen.c tcp: annotate data-races around fastopenq.max_qlen 2023-07-27 08:47:04 +02:00
tcp_highspeed.c tcp: add accessors to read/set tp->snd_cwnd 2022-06-14 18:36:11 +02:00
tcp_htcp.c tcp: add accessors to read/set tp->snd_cwnd 2022-06-14 18:36:11 +02:00
tcp_hybla.c tcp: add accessors to read/set tp->snd_cwnd 2022-06-14 18:36:11 +02:00
tcp_illinois.c tcp: add accessors to read/set tp->snd_cwnd 2022-06-14 18:36:11 +02:00
tcp_input.c tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). 2025-10-19 16:21:41 +02:00
tcp_ipv4.c tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process 2024-10-17 15:11:26 +02:00
tcp_lp.c tcp: add accessors to read/set tp->snd_cwnd 2022-06-14 18:36:11 +02:00
tcp_metrics.c tcp_metrics: validate source addr length 2024-07-18 13:07:30 +02:00
tcp_minisocks.c tcp: Defer ts_recent changes until req is owned 2025-03-13 12:50:57 +01:00
tcp_nv.c tcp: add accessors to read/set tp->snd_cwnd 2022-06-14 18:36:11 +02:00
tcp_offload.c net-timestamp: support TCP GSO case for a few missing flags 2025-03-13 12:51:07 +01:00
tcp_output.c tcp: fix tcp_tso_should_defer() vs large RTT 2025-10-29 14:03:08 +01:00
tcp_rate.c tcp: add accessors to read/set tp->snd_cwnd 2022-06-14 18:36:11 +02:00
tcp_recovery.c tcp: fix excessive TLP and RACK timeouts from HZ rounding 2023-10-25 11:58:57 +02:00
tcp_scalable.c tcp: add accessors to read/set tp->snd_cwnd 2022-06-14 18:36:11 +02:00
tcp_timer.c tcp: fix race in tcp_write_err() 2024-08-19 05:44:56 +02:00
tcp_ulp.c net/ulp: use consistent error code when blocking ULP 2023-01-24 07:22:48 +01:00
tcp_vegas.c tcp: add accessors to read/set tp->snd_cwnd 2022-06-14 18:36:11 +02:00
tcp_vegas.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
tcp_veno.c tcp: add accessors to read/set tp->snd_cwnd 2022-06-14 18:36:11 +02:00
tcp_westwood.c tcp: add accessors to read/set tp->snd_cwnd 2022-06-14 18:36:11 +02:00
tcp_yeah.c tcp: add accessors to read/set tp->snd_cwnd 2022-06-14 18:36:11 +02:00
tunnel4.c net: Remove the member netns_ok 2021-05-17 15:29:35 -07:00
udp.c udp: Fix memory accounting leak. 2025-10-19 16:21:27 +02:00
udp_bpf.c bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() 2023-03-17 08:48:54 +01:00
udp_diag.c net: Use nlmsg_unicast() instead of netlink_unicast() 2021-07-13 09:28:29 -07:00
udp_impl.h net: pass a sockptr_t into ->setsockopt 2020-07-24 15:41:54 -07:00
udp_offload.c udp: also consider secpath when evaluating ipsec use for checksumming 2025-08-28 16:24:16 +02:00
udp_tunnel_core.c net/tunnel: wait until all sk_user_data reader finish before releasing the sock 2022-12-31 13:14:19 +01:00
udp_tunnel_nic.c udp_tunnel: use netdev_warn() instead of netdev_WARN() 2025-12-07 06:09:22 +09:00
udp_tunnel_stub.c udp_tunnel: add central NIC RX port offload infrastructure 2020-07-10 13:54:00 -07:00
udplite.c udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). 2023-05-30 13:55:31 +01:00
xfrm4_input.c xfrm: Preserve vlan tags for transport mode software GRO 2024-05-17 11:50:57 +02:00
xfrm4_output.c xfrm: fix unused variable warning if CONFIG_NETFILTER=n 2020-05-11 15:12:27 +02:00
xfrm4_policy.c xfrm: respect ip protocols rules criteria when performing dst lookups 2024-11-01 01:52:36 +01:00
xfrm4_protocol.c net: xfrm: unexport __init-annotated xfrm4_protocol_init() 2022-06-14 18:36:18 +02:00
xfrm4_state.c xfrm: remove output_finish indirection from xfrm_state_afinfo 2020-05-06 09:40:08 +02:00
xfrm4_tunnel.c xfrm: remove description from xfrm_type struct 2021-06-09 09:38:52 +02:00