netdev - [PATCH v2] net: rtnetlink: Fix rtnl_dereference may be return NULL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu,  8 Jul 2021 17:29:36 +0800
From:   Yajun Deng <yajun.deng@...ux.dev>
To:     davem@...emloft.net, kuba@...nel.org, ryazanov.s.a@...il.com,
        johannes.berg@...el.com, avagin@...il.com, vladimir.oltean@....com,
        cong.wang@...edance.com, roopa@...ulusnetworks.com,
        yajun.deng@...ux.dev, zhudi21@...wei.com, edumazet@...gle.com
Cc:     netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH v2] net: rtnetlink: Fix rtnl_dereference may be return NULL

The value 'link' may be NULL in rtnl_unregister(), this leads to
kfree_rcu(NULL, xxx), so add this case handling. And modify the return
value to 'void' in rtnl_unregister(). there is no case using it.

Fixes: addf9b90de22 (net: rtnetlink: use rcu to free rtnl message handlers)
Fixes: 51e13685bd93 (rtnetlink: RCU-annotate both dimensions of rtnl_msg_handlers)
Signed-off-by: Yajun Deng <yajun.deng@...ux.dev>
---
 include/net/rtnetlink.h |  2 +-
 net/core/rtnetlink.c    | 18 ++++++++----------
 2 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index 384e800665f2..9d263ad9ea48 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -17,7 +17,7 @@ void rtnl_register(int protocol, int msgtype,
 		   rtnl_doit_func, rtnl_dumpit_func, unsigned int flags);
 int rtnl_register_module(struct module *owner, int protocol, int msgtype,
 			 rtnl_doit_func, rtnl_dumpit_func, unsigned int flags);
-int rtnl_unregister(int protocol, int msgtype);
+void rtnl_unregister(int protocol, int msgtype);
 void rtnl_unregister_all(int protocol);
 
 static inline int rtnl_msg_family(const struct nlmsghdr *nlh)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index f6af3e74fc44..e80177c195a5 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -281,10 +281,8 @@ void rtnl_register(int protocol, int msgtype,
  * rtnl_unregister - Unregister a rtnetlink message type
  * @protocol: Protocol family or PF_UNSPEC
  * @msgtype: rtnetlink message type
- *
- * Returns 0 on success or a negative error code.
  */
-int rtnl_unregister(int protocol, int msgtype)
+void rtnl_unregister(int protocol, int msgtype)
 {
 	struct rtnl_link __rcu **tab;
 	struct rtnl_link *link;
@@ -295,18 +293,18 @@ int rtnl_unregister(int protocol, int msgtype)
 
 	rtnl_lock();
 	tab = rtnl_dereference(rtnl_msg_handlers[protocol]);
-	if (!tab) {
-		rtnl_unlock();
-		return -ENOENT;
-	}
+	if (!tab)
+		goto unlock;
 
 	link = rtnl_dereference(tab[msgindex]);
-	rcu_assign_pointer(tab[msgindex], NULL);
-	rtnl_unlock();
+	if (!link)
+		goto unlock;
 
+	rcu_assign_pointer(tab[msgindex], NULL);
 	kfree_rcu(link, rcu);
 
-	return 0;
+unlock:
+	rtnl_unlock();
 }
 EXPORT_SYMBOL_GPL(rtnl_unregister);
 
-- 
2.32.0