Skip to content
Commit af232e76 authored by Eric Dumazet's avatar Eric Dumazet Committed by Jakub Kicinski
Browse files

ipv6: guard ip6_mr_output() with rcu



syzbot found at least one path leads to an ip_mr_output()
without RCU being held.

Add guard(rcu)() to fix this in a concise way.

WARNING: net/ipv6/ip6mr.c:2376 at ip6_mr_output+0xe0b/0x1040 net/ipv6/ip6mr.c:2376, CPU#1: kworker/1:2/121
Call Trace:
 <TASK>
  ip6tunnel_xmit include/net/ip6_tunnel.h:162 [inline]
  udp_tunnel6_xmit_skb+0x640/0xad0 net/ipv6/ip6_udp_tunnel.c:112
  send6+0x5ac/0x8d0 drivers/net/wireguard/socket.c:152
  wg_socket_send_skb_to_peer+0x111/0x1d0 drivers/net/wireguard/socket.c:178
  wg_packet_create_data_done drivers/net/wireguard/send.c:251 [inline]
  wg_packet_tx_worker+0x1c8/0x7c0 drivers/net/wireguard/send.c:276
  process_one_work kernel/workqueue.c:3239 [inline]
  process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3322
  worker_thread+0x8a0/0xda0 kernel/workqueue.c:3403
  kthread+0x70e/0x8a0 kernel/kthread.c:464
  ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Fixes: 96e8f5a9 ("net: ipv6: Add ip6_mr_output()")
Reported-by: default avatar <syzbot+0141c834e47059395621@syzkaller.appspotmail.com>
Closes: https://lore.kernel.org/netdev/685e86b3.a00a0220.129264.0003.GAE@google.com/T/#u


Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: Roopa Prabhu <roopa@nvidia.com>
Cc: Benjamin Poirier <bpoirier@nvidia.com>
Cc: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: default avatarNikolay Aleksandrov <razor@blackwall.org>
Reviewed-by: default avatarPetr Machata <petrm@nvidia.com>
Link: https://patch.msgid.link/20250627115822.3741390-1-edumazet@google.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 64749642
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment