Thank you for the review, Manvi. I've attached poc_fan_prefix.c — a standalone reproducer for Bug 1 (missing prefix validation).
BUILD AND RUN (on Ubuntu Noble 6.8): gcc -o poc_prefix poc_fan_prefix.c unshare -Urn ./poc_prefix What it does: 1. Creates a netlink socket and sends RTM_NEWLINK for an ipip FAN tunnel 2. Sets overlay_prefix=255 and underlay_prefix=0 (both out of valid range [0,32]) 3. On vulnerable kernel: tunnel created with bogus masks, UB in shift operations 4. On fixed kernel: EINVAL returned Expected output on VULNERABLE kernel: [!] VULNERABLE: tunnel created with bogus prefix [*] inet_make_mask(255) = undefined behavior [*] shift (0 - 255) = negative = UB Expected output on FIXED kernel: [+] FIXED: kernel rejected invalid prefix (EINVAL) ROOT CAUSE (Bug 1): net/ipv4/ipip.c:609-661 — fan_build_header() uses overlay_prefix and underlay_prefix from user-controlled netlink attributes without validating they are in [0, 32]. The transmit path computes: shift = underlay_prefix - overlay_prefix When underlay_prefix < overlay_prefix, shift is negative (undefined behavior). inet_make_mask() also has UB for values > 32. On x86, the shift wraps (masked to 5 bits) producing wrong destination addresses. Triggerable via unshare -Urn (unprivileged user+net namespace). ROOT CAUSE (Bug 2): net/ipv4/ipip.c:585-589 — fan_flush_map() uses list_for_each_entry_rcu() while calling list_del_rcu() + kfree_rcu() on each entry. Should use list_for_each_entry_safe(). Works by accident because list_del_rcu() preserves next pointers, but generates lockdep warnings and violates RCU list API contract. SUGGESTED FIX: Bug 1: Validate overlay_prefix and underlay_prefix in [0, 32] and require underlay_prefix >= overlay_prefix in fan_parse_map() before storing the values. Bug 2: Replace list_for_each_entry_rcu() with list_for_each_entry_safe() in fan_flush_map(). ** Attachment added: "poc_fan_prefix.c" https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2173154/+attachment/6015554/+files/poc_fan_prefix.c -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2173154 Title: [Ubuntu Noble 6.8] FAN ipip/VXLAN: missing prefix validation + unsafe list iteration in fan_flush_map To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2173154/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
