[LTS 9.4] ndisc: use RCU protection in ndisc_alloc_skb() #546
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…_rcu() jira VULN-54027 cve-pre CVE-2025-21764 commit-author Jiri Pirko <jiri@nvidia.com> commit 2034d90 Make the net pointer stored in possible_net_t structure annotated as an RCU pointer. Change the access helpers to treat it as such. Introduce read_pnet_rcu() helper to allow caller to dereference the net pointer under RCU read lock. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net> (cherry picked from commit 2034d90) Signed-off-by: Marcin Wcisło <marcin.wcislo@conclusive.pl>
jira VULN-54027 cve-pre CVE-2025-21764 commit-author Eric Dumazet <edumazet@google.com> commit 482ad2a dev->nd_net can change, readers should either use rcu_read_lock() or RTNL. We currently use a generic helper, dev_net() with no debugging support. We probably have many hidden bugs. Add dev_net_rcu() helper for callers using rcu_read_lock() protection. Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Link: https://patch.msgid.link/20250205155120.1676781-2-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit 482ad2a) Signed-off-by: Marcin Wcisło <marcin.wcislo@conclusive.pl>
jira VULN-54027 cve CVE-2025-21764 commit-author Eric Dumazet <edumazet@google.com> commit 628e6d1 ndisc_alloc_skb() can be called without RTNL or RCU being held. Add RCU protection to avoid possible UAF. Fixes: de09334 ("ndisc: Introduce ndisc_alloc_skb() helper.") Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: David Ahern <dsahern@kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-3-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit 628e6d1) Signed-off-by: Marcin Wcisło <marcin.wcislo@conclusive.pl>
PlaidCat
requested review from
PlaidCat,
bmastbergen,
kerneltoast,
shreeya-patel98 and
thefossguy-ciq
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
[LTS 9.4]
CVE-2025-21764
VULN-54027
Problem
https://access.redhat.com/security/cve/CVE-2025-21764
Solution
The mainline fix 628e6d1 uses
dev_net_rcu(…)function defined in 482ad2a, which in turn usesread_pnet_rcu(…)defined in 2034d90, none of which were backported tociqlts9_4, so they were included in this PR.Consider the comparative timeline of
net/ipv6/ndisc.candinclude/net/net_namespace.hfiles changes in the mainline kernel, stable linux 5.15 and LTS 9.4 - all of the commits mentioned were backported to 5.15 along with CVE-2025-21764 patch:timeline.log
Legend:
The
dev_net_rcu(…)function defined in 482ad2a was specifically put as a groundwork for the patch series (https://lore.kernel.org/all/20250207135841.1948589-3-edumazet@google.com/) to which 628e6d1 belongs:https://lore.kernel.org/all/173888823503.1713650.11309572430849516645.git-patchwork-notify@kernel.org/
Apart from adding the
read_pnet_rcu(…)function the 2034d90 commit modifies also the existingread_pnet(…)andwrite_pnet(…)functions used in other places of kernel code (it affects LTS 9.4 asCONFIG_NET_NSis enabled in allciqlts9_4configs). However, the semantics remain unchanged and only the additional RCU-related protections are introduced. See the documentation for thercu_assign_pointer(…)macrokernel-src-tree/include/linux/rcupdate.h
Lines 489 to 501 in 72caef5
and the definition of
__rcu_dereference_protected(…)kernel-src-tree/include/linux/rcupdate.h
Lines 468 to 473 in 72caef5
by which
rcu_dereference_protected(…)is expressed:kernel-src-tree/include/linux/rcupdate.h
Lines 673 to 674 in 72caef5
kABI check: passed
Boot test: passed
boot-test.log
Kselftests: passed relative
Coverage
Only the net-related tests were run (at least for the patch, the reference test run contains full scope).
Reference
kselftests–ciqlts9_4–run1.log
Patch
kselftests–ciqlts9_4-CVE-2025-21764–run1.log
kselftests–ciqlts9_4-CVE-2025-21764–run2.log
Comparison
The tests results for the reference and patched kernel are the same
Specific tests: skipped