netdev - Re: [PATCH net] net: phy: sfp: Prevent NULL deference of socket

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180915073228.GE30658@n2100.armlinux.org.uk>
Date:   Sat, 15 Sep 2018 08:32:28 +0100
From:   Russell King - ARM Linux <linux@...linux.org.uk>
To:     Florian Fainelli <f.fainelli@...il.com>
Cc:     netdev@...r.kernel.org, Andrew Lunn <andrew@...n.ch>,
        "David S. Miller" <davem@...emloft.net>,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH net] net: phy: sfp: Prevent NULL deference of socket_ops

On Fri, Sep 14, 2018 at 04:01:31PM -0700, Florian Fainelli wrote:
> In case we have specified a SFP and an I2C phandle in the Device Tree,
> but we somehow failed to look up the I2C adapter (e.g: the driver is not
> enabled), we will leave dangling socket_ops, and the sfp_bus will still
> have been registered. We can then observe NULL pointer dereferences
> while doing ethtool -m:
> 
> [   20.218613] Unable to handle kernel NULL pointer dereference at virtual address 00000008
> [   20.226977] pgd = (ptrval)
> [   20.229785] [00000008] *pgd=7c400831, *pte=00000000, *ppte=00000000
> [   20.236274] Internal error: Oops: 17 [#1] SMP ARM
> [   20.241122] Modules linked in:
> [   20.244278] CPU: 0 PID: 1480 Comm: ethtool Not tainted 4.19.0-rc3 #138
> [   20.251013] Hardware name: Broadcom Northstar Plus SoC
> [   20.256316] PC is at sfp_get_module_info+0x8/0x10
> [   20.261172] LR is at dev_ethtool+0x218c/0x2afc
> 
> Specifically guard against that.

The other alternative to this would be to only set ndev->sfp_bus when
the bus moves to registered state, which would probably be a saner
alternative than to add an additional layer of tests.  IOW:

 drivers/net/phy/sfp-bus.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c
index 48ca980f5c96..c4c2b5269216 100644
--- a/drivers/net/phy/sfp-bus.c
+++ b/drivers/net/phy/sfp-bus.c
@@ -362,6 +362,7 @@ static int sfp_register_bus(struct sfp_bus *bus)
 	}
 	if (bus->started)
 		bus->socket_ops->start(bus->sfp);
+	bus->netdev->sfp_bus = bus;
 	bus->registered = true;
 	return 0;
 }
@@ -370,6 +371,7 @@ static void sfp_unregister_bus(struct sfp_bus *bus)
 {
 	const struct sfp_upstream_ops *ops = bus->upstream_ops;
 
+	bus->netdev->sfp_bus = NULL;
 	if (bus->registered) {
 		if (bus->started)
 			bus->socket_ops->stop(bus->sfp);
@@ -451,7 +453,6 @@ static void sfp_upstream_clear(struct sfp_bus *bus)
 {
 	bus->upstream_ops = NULL;
 	bus->upstream = NULL;
-	bus->netdev->sfp_bus = NULL;
 	bus->netdev = NULL;
 }
 
@@ -480,7 +481,6 @@ struct sfp_bus *sfp_register_upstream(struct fwnode_handle *fwnode,
 		bus->upstream_ops = ops;
 		bus->upstream = upstream;
 		bus->netdev = ndev;
-		ndev->sfp_bus = bus;
 
 		if (bus->sfp) {
 			ret = sfp_register_bus(bus);

-- 
RMK's Patch system: http://www.armlinux.org.uk/developer/patches/
FTTC broadband for 0.8mile line in suburbia: sync at 13.8Mbps down 630kbps up
According to speedtest.net: 13Mbps down 490kbps up