In the Linux kernel, the following vulnerability has been resolved:
ila: call nfunregisternet_hooks() sooner
syzbot found an use-after-free Read in ilanfinput [1]
Issue here is that ilaxlatexitnet() frees the rhashtable, then call nfunregisternethooks().
It should be done in the reverse way, with a synchronize_rcu().
This is a good match for a pre_exit() method.
[1] BUG: KASAN: use-after-free in rhtkeyhashfn include/linux/rhashtable.h:159 [inline] BUG: KASAN: use-after-free in _rhashtablelookup include/linux/rhashtable.h:604 [inline] BUG: KASAN: use-after-free in rhashtablelookup include/linux/rhashtable.h:646 [inline] BUG: KASAN: use-after-free in rhashtablelookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672 Read of size 4 at addr ffff888064620008 by task ksoftirqd/0/16
CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.11.0-rc4-syzkaller-00238-g2ad6d23f465a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> _dumpstack lib/dumpstack.c:93 [inline] dumpstacklvl+0x241/0x360 lib/dumpstack.c:119 printaddressdescription mm/kasan/report.c:377 [inline] printreport+0x169/0x550 mm/kasan/report.c:488 kasanreport+0x143/0x180 mm/kasan/report.c:601 rhtkeyhashfn include/linux/rhashtable.h:159 [inline] _rhashtablelookup include/linux/rhashtable.h:604 [inline] rhashtablelookup include/linux/rhashtable.h:646 [inline] rhashtablelookupfast+0x77a/0x9b0 include/linux/rhashtable.h:672 ilalookupwildcards net/ipv6/ila/ilaxlat.c:132 [inline] ilaxlataddr net/ipv6/ila/ilaxlat.c:652 [inline] ilanfinput+0x1fe/0x3c0 net/ipv6/ila/ilaxlat.c:190 nfhookentryhookfn include/linux/netfilter.h:154 [inline] nfhookslow+0xc3/0x220 net/netfilter/core.c:626 nfhook include/linux/netfilter.h:269 [inline] NFHOOK+0x29e/0x450 include/linux/netfilter.h:312 _netifreceiveskbonecore net/core/dev.c:5661 [inline] _netifreceiveskb+0x1ea/0x650 net/core/dev.c:5775 processbacklog+0x662/0x15b0 net/core/dev.c:6108 _napipoll+0xcb/0x490 net/core/dev.c:6772 napipoll net/core/dev.c:6841 [inline] netrxaction+0x89b/0x1240 net/core/dev.c:6963 handlesoftirqs+0x2c4/0x970 kernel/softirq.c:554 runksoftirqd+0xca/0x130 kernel/softirq.c:928 smpbootthreadfn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 retfromfork+0x4b/0x80 arch/x86/kernel/process.c:147 retfromforkasm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>
The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x64620 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) pagetype: 0xbfffffff(buddy) raw: 00fff00000000000 ffffea0000959608 ffffea00019d9408 0000000000000000 raw: 0000000000000000 0000000000000003 00000000bfffffff 0000000000000000 page dumped because: kasan: bad access detected pageowner tracks the page as freed page last allocated via order 3, migratetype Unmovable, gfpmask 0x52dc0(GFPKERNEL|GFPNOWARN|GFPNORETRY|GFPCOMP|GFPZERO), pid 5242, tgid 5242 (syz-executor), ts 73611328570, freets 618981657187 setpageowner include/linux/pageowner.h:32 [inline] postallochook+0x1f3/0x230 mm/pagealloc.c:1493 prepnewpage mm/pagealloc.c:1501 [inline] getpagefromfreelist+0x2e4c/0x2f10 mm/pagealloc.c:3439 allocpagesnoprof+0x256/0x6c0 mm/pagealloc.c:4695 _allocpagesnodenoprof include/linux/gfp.h:269 [inline] allocpagesnodenoprof include/linux/gfp.h:296 [inline] kmalloclargenode+0x8b/0x1d0 mm/slub.c:4103 _kmalloclargenodenoprof+0x1a/0x80 mm/slub.c:4130 _dokmallocnode mm/slub.c:4146 [inline] _kmallocnodenoprof+0x2d2/0x440 mm/slub.c:4164 _kvmallocnodenoprof+0x72/0x190 mm/util.c:650 buckettablealloc lib/rhashtable.c:186 [inline] rhashtableinitnoprof+0x534/0xa60 lib/rhashtable.c:1071 ilaxlatinitnet+0xa0/0x110 net/ipv6/ila/ilaxlat.c:613 ops_ini ---truncated---
[ { "signature_type": "Line", "id": "CVE-2024-46782-003b3db9", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bda4d84ac0d5421b346faee720011f58bdb99673", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila_xlat.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "322150844512318901393063483321659098789", "171407170998708310929700225605386850580", "74685141184010633616610177597196652894", "325608214484505155841807849239241749622", "253796031479191488625768287320965784887", "296983944157963112595564776366753837702", "313613204613554585919960296618368697291", "192471475816269080721097463629365506476", "264409096436112866706585769777627228559" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-086ef941", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@925c18a7cff93d8a4320d652351294ff7d0ac93c", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "169924549330826320628470115202026465103", "171172436164572181865301546820746202929", "211804965008338009020177862984219666034", "247614171707157274081974103751550210153" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-08b43354", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93ee345ba349922834e6a9d1dadabaedcc12dce6", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila_main.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "44776801277465697061796076993031597642", "19636079396667385268979344035077788846", "77492636180362788483797852645280731045", "308113436052294896215274652507540700750", "264391831391352151167756669531090433949", "284449844769992743065481046247045791626", "195965784447226388336387358022803968599" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-161a395e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bda4d84ac0d5421b346faee720011f58bdb99673", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "169924549330826320628470115202026465103", "171172436164572181865301546820746202929", "211804965008338009020177862984219666034", "247614171707157274081974103751550210153" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-1aa70e55", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcaf4e2216824839d26727a15b638c6a677bd9fc", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila_main.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "44776801277465697061796076993031597642", "19636079396667385268979344035077788846", "77492636180362788483797852645280731045", "308113436052294896215274652507540700750", "264391831391352151167756669531090433949", "284449844769992743065481046247045791626", "195965784447226388336387358022803968599" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-1ba93da3", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@031ae72825cef43e4650140b800ad58bf7a6a466", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila_main.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "44776801277465697061796076993031597642", "19636079396667385268979344035077788846", "77492636180362788483797852645280731045", "308113436052294896215274652507540700750", "264391831391352151167756669531090433949", "284449844769992743065481046247045791626", "195965784447226388336387358022803968599" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-1d5a76ea", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18a5a16940464b301ea91bf5da3a324aedb347b2", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila_xlat.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "315593787807376580288807756727584859064", "171407170998708310929700225605386850580", "74685141184010633616610177597196652894", "325608214484505155841807849239241749622", "253796031479191488625768287320965784887", "296983944157963112595564776366753837702", "313613204613554585919960296618368697291", "192471475816269080721097463629365506476", "264409096436112866706585769777627228559" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-46782-240695b1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93ee345ba349922834e6a9d1dadabaedcc12dce6", "signature_version": "v1", "target": { "function": "ila_xlat_exit_net", "file": "net/ipv6/ila/ila_xlat.c" }, "digest": { "function_hash": "4727232321926093653036709260821713325", "length": 291.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-3107ab7b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcaf4e2216824839d26727a15b638c6a677bd9fc", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "169924549330826320628470115202026465103", "171172436164572181865301546820746202929", "211804965008338009020177862984219666034", "247614171707157274081974103751550210153" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-38f25df0", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47abd8adddbc0aecb8f231269ef659148d5dabe4", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "169924549330826320628470115202026465103", "171172436164572181865301546820746202929", "211804965008338009020177862984219666034", "247614171707157274081974103751550210153" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-46782-5a7af6d7", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcaf4e2216824839d26727a15b638c6a677bd9fc", "signature_version": "v1", "target": { "function": "ila_xlat_exit_net", "file": "net/ipv6/ila/ila_xlat.c" }, "digest": { "function_hash": "4727232321926093653036709260821713325", "length": 291.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-46782-5b64c507", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@031ae72825cef43e4650140b800ad58bf7a6a466", "signature_version": "v1", "target": { "function": "ila_xlat_exit_net", "file": "net/ipv6/ila/ila_xlat.c" }, "digest": { "function_hash": "4727232321926093653036709260821713325", "length": 291.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-76a7a9e9", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43d34110882b97ba1ec66cc8234b18983efb9abf", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "169924549330826320628470115202026465103", "171172436164572181865301546820746202929", "211804965008338009020177862984219666034", "247614171707157274081974103751550210153" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-46782-79e70af9", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bda4d84ac0d5421b346faee720011f58bdb99673", "signature_version": "v1", "target": { "function": "ila_xlat_exit_net", "file": "net/ipv6/ila/ila_xlat.c" }, "digest": { "function_hash": "4727232321926093653036709260821713325", "length": 291.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-801cd2ad", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18a5a16940464b301ea91bf5da3a324aedb347b2", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila_main.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "44776801277465697061796076993031597642", "19636079396667385268979344035077788846", "77492636180362788483797852645280731045", "308113436052294896215274652507540700750", "264391831391352151167756669531090433949", "284449844769992743065481046247045791626", "195965784447226388336387358022803968599" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-46782-82b13de1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@925c18a7cff93d8a4320d652351294ff7d0ac93c", "signature_version": "v1", "target": { "function": "ila_xlat_exit_net", "file": "net/ipv6/ila/ila_xlat.c" }, "digest": { "function_hash": "4727232321926093653036709260821713325", "length": 291.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-831d96c3", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18a5a16940464b301ea91bf5da3a324aedb347b2", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "169924549330826320628470115202026465103", "171172436164572181865301546820746202929", "211804965008338009020177862984219666034", "247614171707157274081974103751550210153" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-8c7c0d24", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@031ae72825cef43e4650140b800ad58bf7a6a466", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "169924549330826320628470115202026465103", "171172436164572181865301546820746202929", "211804965008338009020177862984219666034", "247614171707157274081974103751550210153" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-46782-8e5170d6", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43d34110882b97ba1ec66cc8234b18983efb9abf", "signature_version": "v1", "target": { "function": "ila_xlat_exit_net", "file": "net/ipv6/ila/ila_xlat.c" }, "digest": { "function_hash": "4727232321926093653036709260821713325", "length": 291.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-8f501824", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bda4d84ac0d5421b346faee720011f58bdb99673", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila_main.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "44776801277465697061796076993031597642", "19636079396667385268979344035077788846", "77492636180362788483797852645280731045", "308113436052294896215274652507540700750", "264391831391352151167756669531090433949", "284449844769992743065481046247045791626", "195965784447226388336387358022803968599" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-925e70d9", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@031ae72825cef43e4650140b800ad58bf7a6a466", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila_xlat.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "315593787807376580288807756727584859064", "171407170998708310929700225605386850580", "74685141184010633616610177597196652894", "325608214484505155841807849239241749622", "253796031479191488625768287320965784887", "296983944157963112595564776366753837702", "313613204613554585919960296618368697291", "192471475816269080721097463629365506476", "264409096436112866706585769777627228559" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-46782-9e11b3d2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47abd8adddbc0aecb8f231269ef659148d5dabe4", "signature_version": "v1", "target": { "function": "ila_xlat_exit_net", "file": "net/ipv6/ila/ila_xlat.c" }, "digest": { "function_hash": "4727232321926093653036709260821713325", "length": 291.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-9e7c94dd", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcaf4e2216824839d26727a15b638c6a677bd9fc", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila_xlat.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "322150844512318901393063483321659098789", "171407170998708310929700225605386850580", "74685141184010633616610177597196652894", "325608214484505155841807849239241749622", "253796031479191488625768287320965784887", "296983944157963112595564776366753837702", "313613204613554585919960296618368697291", "192471475816269080721097463629365506476", "264409096436112866706585769777627228559" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-c0fe0dcd", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@925c18a7cff93d8a4320d652351294ff7d0ac93c", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila_main.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "44776801277465697061796076993031597642", "19636079396667385268979344035077788846", "77492636180362788483797852645280731045", "308113436052294896215274652507540700750", "264391831391352151167756669531090433949", "284449844769992743065481046247045791626", "195965784447226388336387358022803968599" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-ce21ab1e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93ee345ba349922834e6a9d1dadabaedcc12dce6", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila_xlat.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "322150844512318901393063483321659098789", "171407170998708310929700225605386850580", "74685141184010633616610177597196652894", "325608214484505155841807849239241749622", "253796031479191488625768287320965784887", "296983944157963112595564776366753837702", "313613204613554585919960296618368697291", "192471475816269080721097463629365506476", "264409096436112866706585769777627228559" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-d1bbb8c6", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47abd8adddbc0aecb8f231269ef659148d5dabe4", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila_main.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "44776801277465697061796076993031597642", "19636079396667385268979344035077788846", "77492636180362788483797852645280731045", "308113436052294896215274652507540700750", "264391831391352151167756669531090433949", "284449844769992743065481046247045791626", "195965784447226388336387358022803968599" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-d434c8aa", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47abd8adddbc0aecb8f231269ef659148d5dabe4", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila_xlat.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "315593787807376580288807756727584859064", "171407170998708310929700225605386850580", "74685141184010633616610177597196652894", "325608214484505155841807849239241749622", "253796031479191488625768287320965784887", "296983944157963112595564776366753837702", "313613204613554585919960296618368697291", "192471475816269080721097463629365506476", "264409096436112866706585769777627228559" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-db4e82a6", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43d34110882b97ba1ec66cc8234b18983efb9abf", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila_main.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "44776801277465697061796076993031597642", "19636079396667385268979344035077788846", "77492636180362788483797852645280731045", "308113436052294896215274652507540700750", "264391831391352151167756669531090433949", "284449844769992743065481046247045791626", "195965784447226388336387358022803968599" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-df040927", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93ee345ba349922834e6a9d1dadabaedcc12dce6", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "169924549330826320628470115202026465103", "171172436164572181865301546820746202929", "211804965008338009020177862984219666034", "247614171707157274081974103751550210153" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-46782-e0bb2dd5", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18a5a16940464b301ea91bf5da3a324aedb347b2", "signature_version": "v1", "target": { "function": "ila_xlat_exit_net", "file": "net/ipv6/ila/ila_xlat.c" }, "digest": { "function_hash": "4727232321926093653036709260821713325", "length": 291.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-e8b871e8", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@925c18a7cff93d8a4320d652351294ff7d0ac93c", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila_xlat.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "315593787807376580288807756727584859064", "171407170998708310929700225605386850580", "74685141184010633616610177597196652894", "325608214484505155841807849239241749622", "253796031479191488625768287320965784887", "296983944157963112595564776366753837702", "313613204613554585919960296618368697291", "192471475816269080721097463629365506476", "264409096436112866706585769777627228559" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-46782-fdda9f14", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43d34110882b97ba1ec66cc8234b18983efb9abf", "signature_version": "v1", "target": { "file": "net/ipv6/ila/ila_xlat.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "322150844512318901393063483321659098789", "171407170998708310929700225605386850580", "74685141184010633616610177597196652894", "325608214484505155841807849239241749622", "253796031479191488625768287320965784887", "296983944157963112595564776366753837702", "313613204613554585919960296618368697291", "192471475816269080721097463629365506476", "264409096436112866706585769777627228559" ] }, "deprecated": false } ]