Created attachment 256375 [details] RTM_GETROUTE with illegal rtm_family The attached program supplies an illegally large rtm_family to netlink RTM_GETROUTE, which causes rt_tables_get_rnh_ptr() to fetch a pointer from beyond the end of V_rt_tables, which can lead to a crash in rib_walk_ext_internal(). With INVARIANTS, this fails: KASSERT(family < (AF_MAX + 1), ("%s: fam out of bounds (%d < %d)", __func__, family, AF_MAX + 1)); # uname -a FreeBSD 15.0-CURRENT FreeBSD 15.0-CURRENT #339 main-n250995-3750873316a1-dirty: Fri Jan 3 08:33:55 EST 2025 rtm@xxx:/usr/obj/usr/rtm/symbsd/src/riscv.riscv64/sys/RTM riscv # cc netlink6c.c # ./a.out panic: Fatal page fault at 0xffffffc0002f6e64: 0x424242424242432a cpuid = 0 time = 1735908209 KDB: stack backtrace: db_trace_self() at db_trace_self db_trace_self_wrapper() at db_trace_self_wrapper+0x36 kdb_backtrace() at kdb_backtrace+0x2c vpanic() at vpanic+0x16e panic() at panic+0x26 page_fault_handler() at page_fault_handler+0x214 do_trap_supervisor() at do_trap_supervisor+0x6c cpu_exception_handler_supervisor() at cpu_exception_handler_supervisor+0x74 --- exception 13, tval = 0x424242424242432a _rm_rlock_debug() at _rm_rlock_debug+0x24 rib_walk() at rib_walk+0x7e dump_rtable_one() at dump_rtable_one+0x68 rtnl_handle_getroute() at rtnl_handle_getroute+0x12c rtnl_handle_message() at rtnl_handle_message+0x12a nl_taskqueue_handler() at nl_taskqueue_handler+0x49a taskqueue_run_locked() at taskqueue_run_locked+0x158 taskqueue_thread_loop() at taskqueue_thread_loop+0xd4 fork_exit() at fork_exit+0x68 fork_trampoline() at fork_trampoline+0xa KDB: enter: panic
I think we should do sanity check within `rtnl_handle_getroute()`. Meanwhile we can give netlink client a meaningful error message.
(In reply to Zhenlei Huang from comment #1) How about renaming rt_tables_get_rnh_safe() -> rt_tables_get_rnh()? The _safe variant was added in fd1aa866eb22 ("routing: add rt_tables_get_rnh_safe() that doesn't panic when af/fib is incorrect.")
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=cdacb12065e4d85416655743da5bc6b17a9d9119 commit cdacb12065e4d85416655743da5bc6b17a9d9119 Author: Gleb Smirnoff <glebius@FreeBSD.org> AuthorDate: 2025-01-29 23:40:56 +0000 Commit: Gleb Smirnoff <glebius@FreeBSD.org> CommitDate: 2025-01-29 23:48:55 +0000 netlink/route: validate family attribute PR: 283818 sys/netlink/route/rt.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)