In the Linux kernel, the following vulnerability has been resolved:
ipv6: release nexthop on device removal
The CI is hitting some aperiodic hangup at device removal time in the pmtu.sh self-test:
unregisternetdevice: waiting for vethA-R1 to become free. Usage count = 6 reftracker: vethA-R1@ffff888013df15d8 has 1/5 users at dstinit+0x84/0x4a0 dstalloc+0x97/0x150 ip6dstalloc+0x23/0x90 ip6rtpcpualloc+0x1e6/0x520 ip6polroute+0x56f/0x840 fib6rulelookup+0x334/0x630 ip6routeoutputflags+0x259/0x480 ip6dstlookuptail.constprop.0+0x5c2/0x940 ip6dstlookupflow+0x88/0x190 udptunnel6dstlookup+0x2a7/0x4c0 vxlanxmitone+0xbde/0x4a50 [vxlan] vxlanxmit+0x9ad/0xf20 [vxlan] devhardstartxmit+0x10e/0x360 _devqueuexmit+0xf95/0x18c0 arpsolicit+0x4a2/0xe00 neighprobe+0xaa/0xf0
While the first suspect is the dstcache, explicitly tracking the dst owing the last device reference via probes proved such dst is held by the nexthop in the originating fib6info.
Similar to commit f5b51fe804ec ("ipv6: route: purge exception on removal"), we need to explicitly release the originating fib info when disconnecting a to-be-removed device from a live ipv6 dst: move the fib6info cleanup into ip6dst_ifdown().
Tested running:
./pmtu.sh cleanupipv6exception
in a tight loop for more than 400 iterations with no spat, running an unpatched kernel I observed a splat every ~10 iterations.
[
{
"target": {
"file": "net/ipv6/route.c",
"function": "ip6_dst_ifdown"
},
"signature_version": "v1",
"id": "CVE-2024-56751-01fc5b7d",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eb02688c5c45c3e7af7e71f036a7144f5639cbfe",
"digest": {
"function_hash": "274181833741433117768394702156930454253",
"length": 283.0
},
"signature_type": "Function"
},
{
"target": {
"file": "net/ipv6/route.c",
"function": "rt6_remove_exception"
},
"signature_version": "v1",
"id": "CVE-2024-56751-04f15752",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@77aa9855a878fb43f547ddfbda3127a1e88ad31a",
"digest": {
"function_hash": "147374859402863029994565236094761352974",
"length": 490.0
},
"signature_type": "Function"
},
{
"target": {
"file": "net/ipv6/route.c"
},
"signature_version": "v1",
"id": "CVE-2024-56751-1c284f04",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eb02688c5c45c3e7af7e71f036a7144f5639cbfe",
"digest": {
"line_hashes": [
"143660982353546743424230537068513887483",
"91900319400325772050420617232385988303",
"252104772808012224198729376088928135750",
"250655405018220570750200526462171506638",
"15457252396331132911561032636818815333",
"168774869241230097468670148110096999253",
"166144027108892451148511233093462093986",
"80765803609771234757054177939565488450",
"81676333130211775615298719002186731612",
"26771086856946239922716176482218825089",
"325940665620582091029057987105962344091",
"290329091230317444921484548632122905652",
"208352578317118388958669297996206067739",
"149356250773098631072549761956130813607",
"122297597866443793013561375969711773077",
"269318197537837530259836174044136595931",
"137934986434951804685322043880853516392"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"target": {
"file": "net/ipv6/route.c",
"function": "ip6_dst_ifdown"
},
"signature_version": "v1",
"id": "CVE-2024-56751-375b3611",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43e25adc80269f917d2a195f0d59f74cdd182955",
"digest": {
"function_hash": "159934568611836230878513064868074842437",
"length": 282.0
},
"signature_type": "Function"
},
{
"target": {
"file": "net/ipv6/route.c",
"function": "ip6_dst_ifdown"
},
"signature_version": "v1",
"id": "CVE-2024-56751-38d688d1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2f26a27ea3f72f75d18330f76f5d1007c791848",
"digest": {
"function_hash": "211475279044173711179703388300514938141",
"length": 296.0
},
"signature_type": "Function"
},
{
"target": {
"file": "net/ipv6/route.c"
},
"signature_version": "v1",
"id": "CVE-2024-56751-41d7fea5",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2f26a27ea3f72f75d18330f76f5d1007c791848",
"digest": {
"line_hashes": [
"218673997929350435132443069738784624827",
"314658926535669494276709516543452025505",
"136644331973440861435629189418874694432",
"250655405018220570750200526462171506638",
"15457252396331132911561032636818815333",
"168774869241230097468670148110096999253",
"166144027108892451148511233093462093986",
"80765803609771234757054177939565488450",
"81676333130211775615298719002186731612",
"26771086856946239922716176482218825089",
"325940665620582091029057987105962344091",
"290329091230317444921484548632122905652",
"208352578317118388958669297996206067739",
"149356250773098631072549761956130813607",
"122297597866443793013561375969711773077",
"269318197537837530259836174044136595931",
"137934986434951804685322043880853516392"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"target": {
"file": "net/ipv6/route.c"
},
"signature_version": "v1",
"id": "CVE-2024-56751-5a685562",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3c3f8a4d025acc8c857246ec2b812c59102487a",
"digest": {
"line_hashes": [
"143660982353546743424230537068513887483",
"91900319400325772050420617232385988303",
"252104772808012224198729376088928135750",
"250655405018220570750200526462171506638",
"15457252396331132911561032636818815333",
"168774869241230097468670148110096999253",
"166144027108892451148511233093462093986",
"80765803609771234757054177939565488450",
"81676333130211775615298719002186731612",
"26771086856946239922716176482218825089",
"325940665620582091029057987105962344091",
"290329091230317444921484548632122905652",
"208352578317118388958669297996206067739",
"149356250773098631072549761956130813607",
"122297597866443793013561375969711773077",
"269318197537837530259836174044136595931",
"137934986434951804685322043880853516392"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"target": {
"file": "net/ipv6/route.c",
"function": "rt6_remove_exception"
},
"signature_version": "v1",
"id": "CVE-2024-56751-611ea12d",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2f26a27ea3f72f75d18330f76f5d1007c791848",
"digest": {
"function_hash": "299189642425822979118422531888016954940",
"length": 485.0
},
"signature_type": "Function"
},
{
"target": {
"file": "net/ipv6/route.c",
"function": "rt6_remove_exception"
},
"signature_version": "v1",
"id": "CVE-2024-56751-76039621",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eb02688c5c45c3e7af7e71f036a7144f5639cbfe",
"digest": {
"function_hash": "299189642425822979118422531888016954940",
"length": 485.0
},
"signature_type": "Function"
},
{
"target": {
"file": "net/ipv6/route.c"
},
"signature_version": "v1",
"id": "CVE-2024-56751-7b1a6c28",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@77aa9855a878fb43f547ddfbda3127a1e88ad31a",
"digest": {
"line_hashes": [
"183402265123071167003014584262013036596",
"18710165603009983166234107798539053049",
"40644817570586282049297101107774185985",
"282626936568939193881476180469956843761",
"47708316798627066427716889506485138847",
"168774869241230097468670148110096999253",
"166144027108892451148511233093462093986",
"80765803609771234757054177939565488450",
"81676333130211775615298719002186731612",
"26771086856946239922716176482218825089",
"325940665620582091029057987105962344091",
"290329091230317444921484548632122905652",
"239957678466036034865568270858160517360",
"80737171304064512647190999711418445614",
"308620565929367851674380412923310944006",
"36987153286895912411052472227271792201",
"137934986434951804685322043880853516392"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"target": {
"file": "net/ipv6/route.c",
"function": "rt6_remove_exception"
},
"signature_version": "v1",
"id": "CVE-2024-56751-bec0f4e5",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3c3f8a4d025acc8c857246ec2b812c59102487a",
"digest": {
"function_hash": "299189642425822979118422531888016954940",
"length": 485.0
},
"signature_type": "Function"
},
{
"target": {
"file": "net/ipv6/route.c",
"function": "ip6_dst_ifdown"
},
"signature_version": "v1",
"id": "CVE-2024-56751-d2413d08",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@77aa9855a878fb43f547ddfbda3127a1e88ad31a",
"digest": {
"function_hash": "202210255549799352202297899593501499001",
"length": 312.0
},
"signature_type": "Function"
},
{
"target": {
"file": "net/ipv6/route.c",
"function": "rt6_remove_exception"
},
"signature_version": "v1",
"id": "CVE-2024-56751-d4e6be1f",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43e25adc80269f917d2a195f0d59f74cdd182955",
"digest": {
"function_hash": "299189642425822979118422531888016954940",
"length": 485.0
},
"signature_type": "Function"
},
{
"target": {
"file": "net/ipv6/route.c",
"function": "ip6_dst_ifdown"
},
"signature_version": "v1",
"id": "CVE-2024-56751-e4ebbb39",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3c3f8a4d025acc8c857246ec2b812c59102487a",
"digest": {
"function_hash": "274181833741433117768394702156930454253",
"length": 283.0
},
"signature_type": "Function"
},
{
"target": {
"file": "net/ipv6/route.c"
},
"signature_version": "v1",
"id": "CVE-2024-56751-f5a818d7",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43e25adc80269f917d2a195f0d59f74cdd182955",
"digest": {
"line_hashes": [
"2893092762859226264626493328696453585",
"314658926535669494276709516543452025505",
"136644331973440861435629189418874694432",
"250655405018220570750200526462171506638",
"15457252396331132911561032636818815333",
"168774869241230097468670148110096999253",
"166144027108892451148511233093462093986",
"80765803609771234757054177939565488450",
"81676333130211775615298719002186731612",
"26771086856946239922716176482218825089",
"325940665620582091029057987105962344091",
"290329091230317444921484548632122905652",
"208352578317118388958669297996206067739",
"149356250773098631072549761956130813607",
"122297597866443793013561375969711773077",
"269318197537837530259836174044136595931",
"137934986434951804685322043880853516392"
],
"threshold": 0.9
},
"signature_type": "Line"
}
]