Eric Dumazet 260466b576 ila: serialize calls to nf_register_net_hooks() ... syzbot found a race in ila_add_mapping() [1] commit 031ae72825 ("ila: call nf_unregister_net_hooks() sooner") attempted to fix a similar issue. Looking at the syzbot repro, we have concurrent ILA_CMD_ADD commands. Add a mutex to make sure at most one thread is calling nf_register_net_hooks(). [1] BUG: KASAN: slab-use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline] BUG: KASAN: slab-use-after-free in __rhashtable_lookup.constprop.0+0x426/0x550 include/linux/rhashtable.h:604 Read of size 4 at addr ffff888028f40008 by task dhcpcd/5501 CPU: 1 UID: 0 PID: 5501 Comm: dhcpcd Not tainted 6.13.0-rc4-syzkaller-00054-gd6ef8b40d075 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xc3/0x620 mm/kasan/report.c:489 kasan_report+0xd9/0x110 mm/kasan/report.c:602 rht_key_hashfn include/linux/rhashtable.h:159 [inline] __rhashtable_lookup.constprop.0+0x426/0x550 include/linux/rhashtable.h:604 rhashtable_lookup include/linux/rhashtable.h:646 [inline] rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline] ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:127 [inline] ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline] ila_nf_input+0x1ee/0x620 net/ipv6/ila/ila_xlat.c:185 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xbb/0x200 net/netfilter/core.c:626 nf_hook.constprop.0+0x42e/0x750 include/linux/netfilter.h:269 NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0xa4/0x680 net/ipv6/ip6_input.c:309 __netif_receive_skb_one_core+0x12e/0x1e0 net/core/dev.c:5672 __netif_receive_skb+0x1d/0x160 net/core/dev.c:5785 process_backlog+0x443/0x15f0 net/core/dev.c:6117 __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6883 napi_poll net/core/dev.c:6952 [inline] net_rx_action+0xa94/0x1010 net/core/dev.c:7074 handle_softirqs+0x213/0x8f0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0x109/0x170 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049 Fixes: 7f00feaf10 ("ila: Add generic ILA translation facility") Reported-by: syzbot+47e761d22ecf745f72b9@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6772c9ae.050a0220.2f3838.04c7.GAE@google.com/T/#u Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Florian Westphal <fw@strlen.de> Cc: Tom Herbert <tom@herbertland.com> Link: https://patch.msgid.link/20241230162849.2795486-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2025-01-02 18:42:32 -08:00
..
ila	ila: serialize calls to nf_register_net_hooks()	2025-01-02 18:42:32 -08:00
netfilter	netfilter pull request 24-11-07	2024-11-07 12:46:04 +01:00
addrconf.c	ipv6: avoid possible NULL deref in modify_prefix_route()	2024-12-01 20:45:23 +00:00
addrconf_core.c
addrlabel.c	ipv6: Use rtnl_register_many().	2024-10-15 18:52:26 -07:00
af_inet6.c	net: inet6: do not leave a dangling sk pointer in inet6_create()	2024-10-15 18:43:08 -07:00
ah6.c
anycast.c	ipv6: switch inet6_acaddr_hash() to less predictable hash	2024-10-09 19:33:57 -07:00
calipso.c	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
datagram.c
esp6.c
esp6_offload.c	xfrm: Add an inbound percpu state cache.	2024-10-29 11:56:18 +01:00
exthdrs.c
exthdrs_core.c
exthdrs_offload.c
fib6_notifier.c	net: do not acquire rtnl in fib_seq_sum()	2024-10-11 15:35:05 -07:00
fib6_rules.c	ipv6: use READ_ONCE()/WRITE_ONCE() on fib6_table->fib_seq	2024-10-11 15:35:05 -07:00
fou6.c
icmp.c
inet6_connection_sock.c
inet6_hashtables.c
ioam6.c	net: convert to nla_get_*_default()	2024-11-11 10:32:06 -08:00
ioam6_iptunnel.c	net: convert to nla_get_*_default()	2024-11-11 10:32:06 -08:00
ip6_checksum.c
ip6_fib.c	ipv6: Fix soft lockups in fib6_select_path under high next hop churn	2024-11-11 15:26:10 -08:00
ip6_flowlabel.c
ip6_gre.c
ip6_icmp.c
ip6_input.c
ip6_offload.c
ip6_offload.h
ip6_output.c	ipv6: Remove redundant unlikely()	2024-10-09 19:40:46 -07:00
ip6_tunnel.c	ipv4: Convert ip_route_input() to dscp_t.	2024-10-03 16:21:21 -07:00
ip6_udp_tunnel.c
ip6_vti.c
ip6mr.c	ipmr: tune the ipmr_can_free_table() checks.	2024-12-04 18:49:16 -08:00
ipcomp6.c
ipv6_sockglue.c
Kconfig	net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL	2024-09-22 19:52:07 +01:00
Makefile
mcast.c
mcast_snoop.c
mip6.c
ndisc.c
netfilter.c
output_core.c
ping.c
proc.c
protocol.c
raw.c	net_tstamp: add SCM_TS_OPT_ID for RAW sockets	2024-10-04 11:52:19 -07:00
reassembly.c
route.c	net/ipv6: release expired exception dst cached in socket	2024-12-02 19:24:54 -08:00
rpl.c
rpl_iptunnel.c
seg6.c
seg6_hmac.c
seg6_iptunnel.c
seg6_local.c	net: ip: make ip_route_input() return drop reasons	2024-11-12 11:24:51 +01:00
sit.c
syncookies.c
sysctl_net_ipv6.c
tcp_ao.c
tcp_ipv6.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2024-11-14 11:29:15 -08:00
tcpv6_offload.c	net: gso: fix tcp fraglist segmentation after pull from frag_list	2024-10-02 17:21:47 -07:00
tunnel6.c
udp.c	ipv6/udp: Add 4-tuple hash for connected socket	2024-11-18 11:56:21 +00:00
udp_impl.h
udp_offload.c
udplite.c
xfrm6_input.c
xfrm6_output.c
xfrm6_policy.c	xfrm: respect ip protocols rules criteria when performing dst lookups	2024-09-23 07:02:07 +02:00
xfrm6_protocol.c
xfrm6_state.c
xfrm6_tunnel.c