nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush

nh_rt_cache_flush() walks nh->f6i_list during an RTNL-serialized nexthop
replace without holding nh->lock, racing the unlocked IPv6 route
add/delete that mutate the list under nh->lock and free fib6_info
entries (nh_rt_cache_flush() is inlined into rtm_new_nexthop()):

  BUG: KASAN: slab-use-after-free in nh_rt_cache_flush (net/ipv4/nexthop.c:2243)
  Read of size 8 at addr ffff888012953e18 by task exploit/146
   nh_rt_cache_flush (net/ipv4/nexthop.c:2243)
   replace_nexthop (net/ipv4/nexthop.c:2610)
   rtm_new_nexthop (net/ipv4/nexthop.c:3323)
   rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)

Unlike the other f6i_list walks, this one bumps each route's sernum via
fib6_update_sernum_upto_root(), which needs tb6_lock; taking nh->lock
around it would invert the established tb6_lock -> nh->lock order and
deadlock. As the only purpose is to invalidate cached dsts, bump the
IPv6 sernum for the whole netns with rt_genid_bump_ipv6() instead,
mirroring the rt_cache_flush() already done for IPv4 just above.

Fixes: 081efd18326e ("ipv6: Protect nh->f6i_list with spinlock and flag.")
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260722002951.2614721-2-xmei5@asu.edu
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c
index eb5c76ac807b2478027e9878c347aca76a52effb..0f1e21a5c812e26ac210a9cc889a98b8b1a20ded 100644 (file)
--- a/net/ipv4/nexthop.c
+++ b/net/ipv4/nexthop.c
@@ -2240,18 +2240,18 @@ static void remove_one_nexthop(struct net *net, struct nexthop *nh,
 static void nh_rt_cache_flush(struct net *net, struct nexthop *nh,
                              struct nexthop *replaced_nh)
 {
-       struct fib6_info *f6i;
        struct nh_group *nhg;
+       bool have_f6i;
        int i;
 
        if (!list_empty(&nh->fi_list))
                rt_cache_flush(net);
 
-       list_for_each_entry(f6i, &nh->f6i_list, nh_list) {
-               spin_lock_bh(&f6i->fib6_table->tb6_lock);
-               fib6_update_sernum_upto_root(net, f6i);
-               spin_unlock_bh(&f6i->fib6_table->tb6_lock);
-       }
+       spin_lock_bh(&nh->lock);
+       have_f6i = !list_empty(&nh->f6i_list);
+       spin_unlock_bh(&nh->lock);
+       if (have_f6i)
+               rt_genid_bump_ipv6(net);
 
        /* if an IPv6 group was replaced, we have to release all old
         * dsts to make sure all refcounts are released