In the Linux kernel, the following vulnerability has been resolved:
ipv4: iptunnel: Fix suspicious RCU usage warning in iptunnel_find()
The per-netns IP tunnel hash table is protected by the RTNL mutex and iptunnelfind() is only called from the control path where the mutex is taken.
Add a lockdep expression to hlistforeachentryrcu() in iptunnelfind() in order to validate that the mutex is held and to silence the suspicious RCU usage warning [1].
[1] WARNING: suspicious RCU usage
net/ipv4/ip_tunnel.c:221 RCU-list traversed in non-reader section!!
other info that might help us debug this:
rcuscheduleractive = 2, debuglocks = 1 1 lock held by ip/362: #0: ffffffff86fc7cb0 (rtnlmutex){+.+.}-{3:3}, at: rtnetlinkrcvmsg+0x377/0xf60
stack backtrace: CPU: 12 UID: 0 PID: 362 Comm: ip Not tainted 6.12.0-rc3-custom-gd95d9a31aceb #139 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: <TASK> dumpstacklvl+0xba/0x110 lockdeprcususpicious.cold+0x4f/0xd6 iptunnelfind+0x435/0x4d0 iptunnelnewlink+0x517/0x7a0 ipgrenewlink+0x14c/0x170 rtnlnewlink+0x1173/0x19c0 rtnlnewlink+0x6c/0xa0 rtnetlinkrcvmsg+0x3cc/0xf60 netlinkrcvskb+0x171/0x450 netlinkunicast+0x539/0x7f0 netlinksendmsg+0x8c1/0xd80 _syssendmsg+0x8f9/0xc20 _syssendmsg+0x197/0x1e0 _syssendmsg+0x122/0x1f0 dosyscall64+0xbb/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 567.0,
"function_hash": "85841669938265132556349568069530482474"
},
"id": "CVE-2024-50304-18fe9130",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0500e4373cd3d5eace1f1712444ab830b82c114",
"target": {
"file": "net/ipv4/ip_tunnel.c",
"function": "ip_tunnel_find"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"192269345449346489040330684649509271329",
"271878422338028834336392496415832009935",
"190544865671144389469673773631444885884",
"5644591817318571109604686097259609897"
]
},
"id": "CVE-2024-50304-3d01a4ac",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f20fe2cfe06ca1b008b09da4f2b4e0c5547ccef6",
"target": {
"file": "net/ipv4/ip_tunnel.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"217548648545999244408747472151784178834",
"278411137716706767667361225098183347500",
"178098421827620804325930204566777765792",
"5644591817318571109604686097259609897"
]
},
"id": "CVE-2024-50304-55ba2d3c",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0500e4373cd3d5eace1f1712444ab830b82c114",
"target": {
"file": "net/ipv4/ip_tunnel.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"192269345449346489040330684649509271329",
"271878422338028834336392496415832009935",
"190544865671144389469673773631444885884",
"5644591817318571109604686097259609897"
]
},
"id": "CVE-2024-50304-65a67b28",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90e0569dd3d32f4f4d2ca691d3fa5a8a14a13c12",
"target": {
"file": "net/ipv4/ip_tunnel.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 599.0,
"function_hash": "88134505462022855691557611022592864541"
},
"id": "CVE-2024-50304-6f3138f1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f20fe2cfe06ca1b008b09da4f2b4e0c5547ccef6",
"target": {
"file": "net/ipv4/ip_tunnel.c",
"function": "ip_tunnel_find"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 599.0,
"function_hash": "88134505462022855691557611022592864541"
},
"id": "CVE-2024-50304-6f3fabca",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90e0569dd3d32f4f4d2ca691d3fa5a8a14a13c12",
"target": {
"file": "net/ipv4/ip_tunnel.c",
"function": "ip_tunnel_find"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 554.0,
"function_hash": "286048755581941674202341173598364353067"
},
"id": "CVE-2024-50304-c6dd222b",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ac5dfa575136da8dd8a9e7c1437c41f3a593993",
"target": {
"file": "net/ipv4/ip_tunnel.c",
"function": "ip_tunnel_find"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"217548648545999244408747472151784178834",
"278411137716706767667361225098183347500",
"178098421827620804325930204566777765792",
"273373284609773211998816791294770472990"
]
},
"id": "CVE-2024-50304-d8432eb6",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ac5dfa575136da8dd8a9e7c1437c41f3a593993",
"target": {
"file": "net/ipv4/ip_tunnel.c"
}
}
]