In the Linux kernel, the following vulnerability has been resolved:
ipvlan: add ipvlanroutev6_outbound() helper
Inspired by syzbot reports using a stack of multiple ipvlan devices.
Reduce stack size needed in ipvlanprocessv6outbound() by moving the flowi6 struct used for the route lookup in an non inlined helper. ipvlanroutev6outbound() needs 120 bytes on the stack, immediately reclaimed.
Also make sure ipvlanprocessv4_outbound() is not inlined.
We might also have to lower MAXNESTDEV, because only syzbot uses setups with more than four stacked devices.
BUG: TASK stack guard page was hit at ffffc9000e803ff8 (stack is ffffc9000e804000..ffffc9000e808000) stack guard page: 0000 [#1] SMP KASAN CPU: 0 PID: 13442 Comm: syz-executor.4 Not tainted 6.1.52-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 RIP: 0010:kasancheckrange+0x4/0x2a0 mm/kasan/generic.c:188 Code: 48 01 c6 48 89 c7 e8 db 4e c1 03 31 c0 5d c3 cc 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc 00 00 cc cc 00 00 cc cc 55 48 89 e5 <41> 57 41 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 a4 01 00 00 48 89 RSP: 0018:ffffc9000e804000 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817e5bf2 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff887c6568 RBP: ffffc9000e804000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92001d0080c R13: dffffc0000000000 R14: ffffffff87e6b100 R15: 0000000000000000 FS: 00007fd0c55826c0(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000e803ff8 CR3: 0000000170ef7000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <#DF> </#DF> <TASK> [<ffffffff81f281d1>] _kasancheckread+0x11/0x20 mm/kasan/shadow.c:31 [<ffffffff817e5bf2>] instrumentatomicread include/linux/instrumented.h:72 [inline] [<ffffffff817e5bf2>] _testbit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] [<ffffffff817e5bf2>] cpumasktestcpu include/linux/cpumask.h:506 [inline] [<ffffffff817e5bf2>] cpuonline include/linux/cpumask.h:1092 [inline] [<ffffffff817e5bf2>] tracelockacquire include/trace/events/lock.h:24 [inline] [<ffffffff817e5bf2>] lockacquire+0xe2/0x590 kernel/locking/lockdep.c:5632 [<ffffffff8563221e>] rculockacquire+0x2e/0x40 include/linux/rcupdate.h:306 [<ffffffff8561464d>] rcureadlock include/linux/rcupdate.h:747 [inline] [<ffffffff8561464d>] ip6polroute+0x15d/0x1440 net/ipv6/route.c:2221 [<ffffffff85618120>] ip6polrouteoutput+0x50/0x80 net/ipv6/route.c:2606 [<ffffffff856f65b5>] pollookupfunc include/net/ip6fib.h:584 [inline] [<ffffffff856f65b5>] fib6rulelookup+0x265/0x620 net/ipv6/fib6rules.c:116 [<ffffffff85618009>] ip6routeoutputflagsnoref+0x2d9/0x3a0 net/ipv6/route.c:2638 [<ffffffff8561821a>] ip6routeoutputflags+0xca/0x340 net/ipv6/route.c:2651 [<ffffffff838bd5a3>] ip6routeoutput include/net/ip6route.h:100 [inline] [<ffffffff838bd5a3>] ipvlanprocessv6outbound drivers/net/ipvlan/ipvlancore.c:473 [inline] [<ffffffff838bd5a3>] ipvlanprocessoutbound drivers/net/ipvlan/ipvlancore.c:529 [inline] [<ffffffff838bd5a3>] ipvlanxmitmodel3 drivers/net/ipvlan/ipvlancore.c:602 [inline] [<ffffffff838bd5a3>] ipvlanqueuexmit+0xc33/0x1be0 drivers/net/ipvlan/ipvlancore.c:677 [<ffffffff838c2909>] ipvlanstartxmit+0x49/0x100 drivers/net/ipvlan/ipvlanmain.c:229 [<ffffffff84d03900>] netdevstartxmit include/linux/netdevice.h:4966 [inline] [<ffffffff84d03900>] xmitone net/core/dev.c:3644 [inline] [<ffffffff84d03900>] devhardstartxmit+0x320/0x980 net/core/dev.c:3660 [<ffffffff84d080e2>] _devqueuexmit+0x16b2/0x3370 net/core/dev.c:4324 [<ffffffff855ce4cd>] devqueuexmit include/linux/netdevice.h:3067 [inline] [<ffffffff855ce4cd>] neighhh_output include/net/neighbour.h:529 [inline] [<f ---truncated---
[
{
"id": "CVE-2023-52796-0e9ad1d1",
"target": {
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"150558340065588950879423682114534454196",
"69363339353695024939824161619185332559",
"281057837866849457212935327970087194055",
"25755359040745007841196789651150915681",
"41795919571117848743118862032908842998",
"322620055700862950736070934732021922900",
"273478858959449202758688377613491701685",
"235506918984369799018117729463293539658",
"181934960524677610635714880916542423328",
"237432249438252694280012179380262947331",
"126276717480046244429022269419126854085",
"227442790496623068538704707513852551597",
"329444311181738871471889306768010194561",
"263760620211064986579295533603708501419",
"175008772611569403076981156444363204015",
"191328590441221512849413446873512624343",
"337414556340342716732995619657411173333",
"125408666853273943473472140559067473966",
"202680266237336700157777157927059294160",
"85871749596225041364155229640197281498",
"93472255731071210803197567535677383749",
"173855818598404112759428948556993730674",
"86909856775349277550720704922282183430",
"125451481316519712653213663665201882541",
"153136439802061191029627480272935386034",
"281117923985047299920146561991773591424",
"250184487942562278422704905453506782366",
"294769551779176590059391966670632243294",
"239362077898976688824482209124994519851",
"35085988778570360676119051263061288580",
"93377451395709950300475513259083059144",
"156718975471545903316005307159742594917",
"325980238621528056544908868335052670480",
"104922190579961438282606693360116703348",
"328598412879935030055426174333162601228",
"279490077886935734318902976213184747715"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8872dc638c24bb774cd2224a69d72a7f661a4d56"
},
{
"id": "CVE-2023-52796-21c5bca3",
"target": {
"function": "ipvlan_process_v6_outbound",
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"signature_version": "v1",
"digest": {
"length": 877.0,
"function_hash": "53930768459046099282206614703033175662"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@732a67ca436887b594ebc43bb5a04ffb0971a760"
},
{
"id": "CVE-2023-52796-22ad1534",
"target": {
"function": "ipvlan_process_v6_outbound",
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"signature_version": "v1",
"digest": {
"length": 877.0,
"function_hash": "53930768459046099282206614703033175662"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03cddc4df8c6be47fd27c8f8b87e5f9a989e1458"
},
{
"id": "CVE-2023-52796-2499d421",
"target": {
"function": "ipvlan_process_v6_outbound",
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"signature_version": "v1",
"digest": {
"length": 877.0,
"function_hash": "53930768459046099282206614703033175662"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43b781e7cb5cd0b435de276111953bf2bacd1f02"
},
{
"id": "CVE-2023-52796-2b457b39",
"target": {
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"150558340065588950879423682114534454196",
"69363339353695024939824161619185332559",
"281057837866849457212935327970087194055",
"25755359040745007841196789651150915681",
"41795919571117848743118862032908842998",
"322620055700862950736070934732021922900",
"273478858959449202758688377613491701685",
"235506918984369799018117729463293539658",
"181934960524677610635714880916542423328",
"237432249438252694280012179380262947331",
"126276717480046244429022269419126854085",
"227442790496623068538704707513852551597",
"329444311181738871471889306768010194561",
"263760620211064986579295533603708501419",
"175008772611569403076981156444363204015",
"191328590441221512849413446873512624343",
"337414556340342716732995619657411173333",
"125408666853273943473472140559067473966",
"202680266237336700157777157927059294160",
"85871749596225041364155229640197281498",
"93472255731071210803197567535677383749",
"173855818598404112759428948556993730674",
"86909856775349277550720704922282183430",
"125451481316519712653213663665201882541",
"153136439802061191029627480272935386034",
"281117923985047299920146561991773591424",
"250184487942562278422704905453506782366",
"294769551779176590059391966670632243294",
"239362077898976688824482209124994519851",
"35085988778570360676119051263061288580",
"93377451395709950300475513259083059144",
"156718975471545903316005307159742594917",
"325980238621528056544908868335052670480",
"104922190579961438282606693360116703348",
"328598412879935030055426174333162601228",
"279490077886935734318902976213184747715"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f64cad3ac38ac5978b53c40e6c5e6fd3477c68f"
},
{
"id": "CVE-2023-52796-2eff86a5",
"target": {
"function": "ipvlan_process_v6_outbound",
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"signature_version": "v1",
"digest": {
"length": 877.0,
"function_hash": "53930768459046099282206614703033175662"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f7f850611aa27aaaf1bf5687702ad2240ae442a"
},
{
"id": "CVE-2023-52796-3047afd7",
"target": {
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"150558340065588950879423682114534454196",
"69363339353695024939824161619185332559",
"281057837866849457212935327970087194055",
"25755359040745007841196789651150915681",
"41795919571117848743118862032908842998",
"322620055700862950736070934732021922900",
"273478858959449202758688377613491701685",
"235506918984369799018117729463293539658",
"181934960524677610635714880916542423328",
"237432249438252694280012179380262947331",
"126276717480046244429022269419126854085",
"227442790496623068538704707513852551597",
"329444311181738871471889306768010194561",
"263760620211064986579295533603708501419",
"175008772611569403076981156444363204015",
"191328590441221512849413446873512624343",
"337414556340342716732995619657411173333",
"125408666853273943473472140559067473966",
"202680266237336700157777157927059294160",
"85871749596225041364155229640197281498",
"93472255731071210803197567535677383749",
"173855818598404112759428948556993730674",
"86909856775349277550720704922282183430",
"125451481316519712653213663665201882541",
"153136439802061191029627480272935386034",
"281117923985047299920146561991773591424",
"250184487942562278422704905453506782366",
"294769551779176590059391966670632243294",
"239362077898976688824482209124994519851",
"35085988778570360676119051263061288580",
"93377451395709950300475513259083059144",
"156718975471545903316005307159742594917",
"325980238621528056544908868335052670480",
"104922190579961438282606693360116703348",
"328598412879935030055426174333162601228",
"279490077886935734318902976213184747715"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f7f850611aa27aaaf1bf5687702ad2240ae442a"
},
{
"id": "CVE-2023-52796-3858bb35",
"target": {
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"150558340065588950879423682114534454196",
"69363339353695024939824161619185332559",
"281057837866849457212935327970087194055",
"25755359040745007841196789651150915681",
"41795919571117848743118862032908842998",
"322620055700862950736070934732021922900",
"273478858959449202758688377613491701685",
"235506918984369799018117729463293539658",
"181934960524677610635714880916542423328",
"237432249438252694280012179380262947331",
"126276717480046244429022269419126854085",
"227442790496623068538704707513852551597",
"329444311181738871471889306768010194561",
"263760620211064986579295533603708501419",
"175008772611569403076981156444363204015",
"191328590441221512849413446873512624343",
"337414556340342716732995619657411173333",
"125408666853273943473472140559067473966",
"202680266237336700157777157927059294160",
"85871749596225041364155229640197281498",
"93472255731071210803197567535677383749",
"173855818598404112759428948556993730674",
"86909856775349277550720704922282183430",
"125451481316519712653213663665201882541",
"153136439802061191029627480272935386034",
"281117923985047299920146561991773591424",
"250184487942562278422704905453506782366",
"294769551779176590059391966670632243294",
"239362077898976688824482209124994519851",
"35085988778570360676119051263061288580",
"93377451395709950300475513259083059144",
"156718975471545903316005307159742594917",
"325980238621528056544908868335052670480",
"104922190579961438282606693360116703348",
"328598412879935030055426174333162601228",
"279490077886935734318902976213184747715"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18f039428c7df183b09c69ebf10ffd4e521035d2"
},
{
"id": "CVE-2023-52796-4a97e565",
"target": {
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"150558340065588950879423682114534454196",
"69363339353695024939824161619185332559",
"281057837866849457212935327970087194055",
"25755359040745007841196789651150915681",
"41795919571117848743118862032908842998",
"322620055700862950736070934732021922900",
"273478858959449202758688377613491701685",
"235506918984369799018117729463293539658",
"181934960524677610635714880916542423328",
"237432249438252694280012179380262947331",
"126276717480046244429022269419126854085",
"227442790496623068538704707513852551597",
"329444311181738871471889306768010194561",
"263760620211064986579295533603708501419",
"175008772611569403076981156444363204015",
"191328590441221512849413446873512624343",
"337414556340342716732995619657411173333",
"125408666853273943473472140559067473966",
"202680266237336700157777157927059294160",
"85871749596225041364155229640197281498",
"93472255731071210803197567535677383749",
"173855818598404112759428948556993730674",
"86909856775349277550720704922282183430",
"125451481316519712653213663665201882541",
"153136439802061191029627480272935386034",
"281117923985047299920146561991773591424",
"250184487942562278422704905453506782366",
"294769551779176590059391966670632243294",
"239362077898976688824482209124994519851",
"35085988778570360676119051263061288580",
"93377451395709950300475513259083059144",
"156718975471545903316005307159742594917",
"325980238621528056544908868335052670480",
"104922190579961438282606693360116703348",
"328598412879935030055426174333162601228",
"279490077886935734318902976213184747715"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@732a67ca436887b594ebc43bb5a04ffb0971a760"
},
{
"id": "CVE-2023-52796-6ea09c4e",
"target": {
"function": "ipvlan_process_v6_outbound",
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"signature_version": "v1",
"digest": {
"length": 877.0,
"function_hash": "53930768459046099282206614703033175662"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d2d30f0792b47908af64c4d02ed1ee25ff50542"
},
{
"id": "CVE-2023-52796-890081ed",
"target": {
"function": "ipvlan_process_v6_outbound",
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"signature_version": "v1",
"digest": {
"length": 877.0,
"function_hash": "53930768459046099282206614703033175662"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18f039428c7df183b09c69ebf10ffd4e521035d2"
},
{
"id": "CVE-2023-52796-aaa6a355",
"target": {
"function": "ipvlan_process_v6_outbound",
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"signature_version": "v1",
"digest": {
"length": 877.0,
"function_hash": "53930768459046099282206614703033175662"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8872dc638c24bb774cd2224a69d72a7f661a4d56"
},
{
"id": "CVE-2023-52796-c2478661",
"target": {
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"150558340065588950879423682114534454196",
"69363339353695024939824161619185332559",
"281057837866849457212935327970087194055",
"25755359040745007841196789651150915681",
"41795919571117848743118862032908842998",
"322620055700862950736070934732021922900",
"273478858959449202758688377613491701685",
"235506918984369799018117729463293539658",
"181934960524677610635714880916542423328",
"237432249438252694280012179380262947331",
"126276717480046244429022269419126854085",
"227442790496623068538704707513852551597",
"329444311181738871471889306768010194561",
"263760620211064986579295533603708501419",
"175008772611569403076981156444363204015",
"191328590441221512849413446873512624343",
"337414556340342716732995619657411173333",
"125408666853273943473472140559067473966",
"202680266237336700157777157927059294160",
"85871749596225041364155229640197281498",
"93472255731071210803197567535677383749",
"173855818598404112759428948556993730674",
"86909856775349277550720704922282183430",
"125451481316519712653213663665201882541",
"153136439802061191029627480272935386034",
"281117923985047299920146561991773591424",
"250184487942562278422704905453506782366",
"294769551779176590059391966670632243294",
"239362077898976688824482209124994519851",
"35085988778570360676119051263061288580",
"93377451395709950300475513259083059144",
"156718975471545903316005307159742594917",
"325980238621528056544908868335052670480",
"104922190579961438282606693360116703348",
"328598412879935030055426174333162601228",
"279490077886935734318902976213184747715"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03cddc4df8c6be47fd27c8f8b87e5f9a989e1458"
},
{
"id": "CVE-2023-52796-c846a898",
"target": {
"function": "ipvlan_process_v6_outbound",
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"signature_version": "v1",
"digest": {
"length": 877.0,
"function_hash": "53930768459046099282206614703033175662"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f64cad3ac38ac5978b53c40e6c5e6fd3477c68f"
},
{
"id": "CVE-2023-52796-cd68db82",
"target": {
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"150558340065588950879423682114534454196",
"69363339353695024939824161619185332559",
"281057837866849457212935327970087194055",
"25755359040745007841196789651150915681",
"41795919571117848743118862032908842998",
"322620055700862950736070934732021922900",
"273478858959449202758688377613491701685",
"235506918984369799018117729463293539658",
"181934960524677610635714880916542423328",
"237432249438252694280012179380262947331",
"126276717480046244429022269419126854085",
"227442790496623068538704707513852551597",
"329444311181738871471889306768010194561",
"263760620211064986579295533603708501419",
"175008772611569403076981156444363204015",
"191328590441221512849413446873512624343",
"337414556340342716732995619657411173333",
"125408666853273943473472140559067473966",
"202680266237336700157777157927059294160",
"85871749596225041364155229640197281498",
"93472255731071210803197567535677383749",
"173855818598404112759428948556993730674",
"86909856775349277550720704922282183430",
"125451481316519712653213663665201882541",
"153136439802061191029627480272935386034",
"281117923985047299920146561991773591424",
"250184487942562278422704905453506782366",
"294769551779176590059391966670632243294",
"239362077898976688824482209124994519851",
"35085988778570360676119051263061288580",
"93377451395709950300475513259083059144",
"156718975471545903316005307159742594917",
"325980238621528056544908868335052670480",
"104922190579961438282606693360116703348",
"328598412879935030055426174333162601228",
"279490077886935734318902976213184747715"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43b781e7cb5cd0b435de276111953bf2bacd1f02"
},
{
"id": "CVE-2023-52796-dd404d23",
"target": {
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"150558340065588950879423682114534454196",
"69363339353695024939824161619185332559",
"281057837866849457212935327970087194055",
"25755359040745007841196789651150915681",
"41795919571117848743118862032908842998",
"322620055700862950736070934732021922900",
"273478858959449202758688377613491701685",
"235506918984369799018117729463293539658",
"181934960524677610635714880916542423328",
"237432249438252694280012179380262947331",
"126276717480046244429022269419126854085",
"227442790496623068538704707513852551597",
"329444311181738871471889306768010194561",
"263760620211064986579295533603708501419",
"175008772611569403076981156444363204015",
"191328590441221512849413446873512624343",
"337414556340342716732995619657411173333",
"125408666853273943473472140559067473966",
"202680266237336700157777157927059294160",
"85871749596225041364155229640197281498",
"93472255731071210803197567535677383749",
"173855818598404112759428948556993730674",
"86909856775349277550720704922282183430",
"125451481316519712653213663665201882541",
"153136439802061191029627480272935386034",
"281117923985047299920146561991773591424",
"250184487942562278422704905453506782366",
"294769551779176590059391966670632243294",
"239362077898976688824482209124994519851",
"35085988778570360676119051263061288580",
"93377451395709950300475513259083059144",
"156718975471545903316005307159742594917",
"325980238621528056544908868335052670480",
"104922190579961438282606693360116703348",
"328598412879935030055426174333162601228",
"279490077886935734318902976213184747715"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d2d30f0792b47908af64c4d02ed1ee25ff50542"
}
]