dhcpcd/src/route.c:338 SEGV by a READ memory access in rt_headclear

[sigdevel]

dhcpcd/src/route.c:338 SEGV by a READ memory access in rt_headclear

Description:

A crafted conf-file supplied via dhcpcd -f <> can trigger a NULL-pointer dereference in rt_headclear() during error-path cleanup of parsed route state. rt_headclear() takes "RB_TREE_MIN(rts)" and unconditionally calls "rt_headclear0" (rt->rt_ifp->ctx, ...); if the route node has rt_ifp == NULL, this dereference crashes at route.c:338. Reproducible in a sandboxed, controlled env with non-system dhcpcd

Output:

asan-build:

show full -click to expand

=================================================================
==905291==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x55fa85a5a7db bp 0x7ffcdfed9d70 sp 0x7ffcdfed9c00 T0)
==905291==The signal is caused by a READ memory access.                                                                                                     
==905291==Hint: address points to the zero page.
    #0 0x55fa85a5a7db in rt_headclear /media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/dhcpcd/dhcpcd_asan/src/route.c:338:28
    #1 0x55fa85a4c6b0 in parse_option /media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/dhcpcd/dhcpcd_asan/src/if-options.c:1323:5
    #2 0x55fa85a3b5d3 in parse_config_line /media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/dhcpcd/dhcpcd_asan/src/if-options.c:2605:10
    #3 0x55fa85a3b5d3 in read_config /media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/dhcpcd/dhcpcd_asan/src/if-options.c:2940:3
    #4 0x55fa85a1e54a in main /media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/dhcpcd/dhcpcd_asan/src/dhcpcd.c:2191:8
    #5 0x7f7cece84ca7 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #6 0x7f7cece84d64 in __libc_start_main csu/../csu/libc-start.c:360:3
    #7 0x55fa85928880 in _start (/media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/dhcpcd/dhcpcd_asan/src/dhcpcd+0x47880) (BuildId: 11c83f634e86387df9e54bcb705fc55c33de9080)

==905291==Register values:
rax = 0x0000000000000000  rbx = 0x0000000000000002  rcx = 0x00000a220000053b  rdx = 0x0000000000000bff  
rdi = 0x0000000000000000  rsi = 0x0000000000000001  rbp = 0x00007ffcdfed9d70  rsp = 0x00007ffcdfed9c00  
 r8 = 0x0000000000000001   r9 = 0x0000000000000001  r10 = 0x0000000000000006  r11 = 0x000055fa85ba7d20  
r12 = 0x0000000000000000  r13 = 0x00007f7ceaf1b120  r14 = 0x00005310000108e0  r15 = 0x000055fa85ba7d20  
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/dhcpcd/dhcpcd_asan/src/route.c:338:28 in rt_headclear
==905291==ABORTING

Environment

OS: tested at 6.12.25-1kali1 (2025-04-30) x86_64 GNU/Linux ;
Compiler version: Clang 19.1.7 ;
Build-opts: -g -O1 -fno-omit-frame-pointer -fsanitize=address,undefined ;
CPU type: x86_64 ;
dhcpcd - commit hash 117742d755b591764036dd4218f314f748a3d2b7 ;

Additional context

link to the sample (github-url):

if-route_c_338

Screenshots

[rsmarples]

@sigdevel this should fix the issue

[sigdevel]

@sigdevel this should fix the issue

сonfirmed, it has been fixed

trace:

show full -click to expand

==6996==Registered root region at 0x7f3fc9401e80 of size 128
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc9401e80 of size 128
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept '__isoc99_printf'
==6996==Registered root region at 0x7f3fc9401e80 of size 128
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc9401e80 of size 128
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept '__isoc99_sprintf'
==6996==Registered root region at 0x7f3fc9401e80 of size 128
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc9401e80 of size 128
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept '__isoc99_snprintf'
==6996==Registered root region at 0x7f3fc9401e80 of size 128
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc9401e80 of size 128
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept '__isoc99_fprintf'
==6996==Registered root region at 0x7f3fc9401e80 of size 128
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc9401e80 of size 128
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept '__isoc99_vprintf'
==6996==Registered root region at 0x7f3fc9401e80 of size 128
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc9401e80 of size 128
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept '__isoc99_vsprintf'
==6996==Registered root region at 0x7f3fc9401e80 of size 128
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc9401e80 of size 128
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept '__isoc99_vsnprintf'
==6996==Registered root region at 0x7f3fc9401e80 of size 128
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc9401e80 of size 128
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept '__isoc99_vfprintf'
==6996==Registered root region at 0x7f3fc9401e80 of size 128
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc9401e80 of size 128
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'pthread_mutexattr_getrobust_np'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdrmem_create'
==6996==Registered root region at 0x7f3fc9401e80 of size 128
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc9401e80 of size 128
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdrstdio_create'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_short'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_u_short'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_int'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_u_int'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_long'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_u_long'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_hyper'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_u_hyper'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_longlong_t'
==6996==Registered root region at 0x7f3fc9401e80 of size 128
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc9401e80 of size 128
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_u_longlong_t'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_int8_t'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_uint8_t'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_int16_t'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_uint16_t'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_int32_t'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_uint32_t'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_int64_t'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_uint64_t'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_quad_t'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_u_quad_t'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_bool'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_enum'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_char'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_u_char'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_float'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_double'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_bytes'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_string'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdrrec_create'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept 'xdr_destroy'
==6996==Registered root region at 0x7f3fc8e01ab0 of size 112
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8e01ab0 of size 112
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept '__cxa_throw'
==6996==Registered root region at 0x7f3fc8c02250 of size 144
==6996==Registered root region at 0x7f3fc90007a0 of size 32
==6996==Unregistered root region at 0x7f3fc8c02250 of size 144
==6996==Unregistered root region at 0x7f3fc90007a0 of size 32
==6996==AddressSanitizer: failed to intercept '__cxa_rethrow_primary_exception'
==6996==AddressSanitizer: libc interceptors initialized
|| `[0x10007fff8000, 0x7fffffffffff]` || HighMem    ||
|| `[0x02008fff7000, 0x10007fff7fff]` || HighShadow ||
|| `[0x00008fff7000, 0x02008fff6fff]` || ShadowGap  ||
|| `[0x00007fff8000, 0x00008fff6fff]` || LowShadow  ||
|| `[0x000000000000, 0x00007fff7fff]` || LowMem     ||
MemToShadow(shadow): 0x00008fff7000 0x000091ff6dff 0x004091ff6e00 0x02008fff6fff
redzone=16
max_redzone=2048
quarantine_size_mb=256M
thread_local_quarantine_size_kb=1024K
malloc_context_size=30
SHADOW_SCALE: 3
SHADOW_GRANULARITY: 8
SHADOW_OFFSET: 0x00007fff8000
==6996==Installed the sigaction for signal 7
==6996==Installed the sigaction for signal 8
==6996==T0: FakeStack created: 0x7f3fc78f7000 -- 0x7f3fc8400000 stack_size_log: 20; mmapped 11300K, noreserve=0 
==6996==T0: stack [0x7ffd725e1000,0x7ffd72de1000) size 0x800000; local=0x7ffd72dde3d4
==6996==AddressSanitizer Init done
unknown option: i�"
unknown option: pnend
unknown option: noi1
all routes need a gateway
unknown option: noi1
static assignment required
unknown option: noi1
unknown option: s
static assignment required
static assignment required
unknown option: 4
unknown option: noi1
unknown option: s
failed to convert leasetime 1,in8 vnd enctlease
unknown option: teap
unknown option: noi1
static assignment required
invalid IP address: eP=
main: mkdir: /var/db/dhcpcd: No such file or directory
main: mkdir: /var/run/dhcpcd: Permission denied
main: pidfile_lock: /var/run/dhcpcd/pid: No such file or directory