linux-kernel - Re: [PATCH v2] net: netpoll: ensure skb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250113-spotted-independent-kittiwake-309cab@leitao>
Date: Mon, 13 Jan 2025 02:09:51 -0800
From: Breno Leitao <leitao@...ian.org>
To: John Sperbeck <jsperbeck@...gle.com>
Cc: "David S . Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>, Paolo Abeni <pabeni@...hat.com>,
	netdev@...r.kernel.org, Simon Horman <horms@...nel.org>,
	linux-kernel@...r.kernel.org, kuba@...nel.org
Subject: Re: [PATCH v2] net: netpoll: ensure skb_pool list is always
 initialized

On Fri, Jan 10, 2025 at 04:32:38PM -0800, John Sperbeck wrote:
> When __netpoll_setup() is called directly, instead of through
> netpoll_setup(), the np->skb_pool list head isn't initialized.
> If skb_pool_flush() is later called, then we hit a NULL pointer
> in skb_queue_purge_reason().  This can be seen with this repro,
> when CONFIG_NETCONSOLE is enabled as a module:
> 
>     ip tuntap add mode tap tap0
>     ip link add name br0 type bridge
>     ip link set dev tap0 master br0
>     modprobe netconsole netconsole=4444@...0.0.1/br0,9353@...0.0.2/
>     rmmod netconsole
> 
> The backtrace is:
> 
>     BUG: kernel NULL pointer dereference, address: 0000000000000008
>     #PF: supervisor write access in kernel mode
>     #PF: error_code(0x0002) - not-present page
>     ... ... ...
>     Call Trace:
>      <TASK>
>      __netpoll_free+0xa5/0xf0
>      br_netpoll_cleanup+0x43/0x50 [bridge]
>      do_netpoll_cleanup+0x43/0xc0
>      netconsole_netdev_event+0x1e3/0x300 [netconsole]
>      unregister_netdevice_notifier+0xd9/0x150
>      cleanup_module+0x45/0x920 [netconsole]
>      __se_sys_delete_module+0x205/0x290
>      do_syscall_64+0x70/0x150
>      entry_SYSCALL_64_after_hwframe+0x76/0x7e
> 
> Move the skb_pool list setup and initial skb fill into __netpoll_setup().
> 
> Fixes: 221a9c1df790 ("net: netpoll: Individualize the skb pool")
> Signed-off-by: John Sperbeck <jsperbeck@...gle.com>

Reviewed-by: Breno Leitao <leitao@...ian.org>

You didn't specify the network tree you are sending this patch for.
Since this patch fixes a commit in 'net' tree (also on Linus' tree), you
want to send it against 'net'.

Something as:
	# git format-patch --subject-prefix='PATCH net'

https://www.kernel.org/doc/html/latest/process/maintainer-netdev.html#indicating-target-tree

Thanks for the fix.
--breno