netdev - Re: [PATCH net] net: dsa: don't dereference NULL extack in dsa_slave

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 19 Aug 2022 19:53:16 -0700
From:   Florian Fainelli <f.fainelli@...il.com>
To:     Vladimir Oltean <vladimir.oltean@....com>, netdev@...r.kernel.org
Cc:     Andrew Lunn <andrew@...n.ch>,
        Vivien Didelot <vivien.didelot@...il.com>,
        Vladimir Oltean <olteanv@...il.com>,
        Clément Léger <clement.leger@...tlin.com>,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>,
        Sergei Antonov <saproj@...il.com>
Subject: Re: [PATCH net] net: dsa: don't dereference NULL extack in
 dsa_slave_changeupper()



On 8/19/2022 10:39 AM, Vladimir Oltean wrote:
> When a driver returns -EOPNOTSUPP in dsa_port_bridge_join() but failed
> to provide a reason for it, DSA attempts to set the extack to say that
> software fallback will kick in.
> 
> The problem is, when we use brctl and the legacy bridge ioctls, the
> extack will be NULL, and DSA dereferences it in the process of setting
> it.
> 
> Sergei Antonov proves this using the following stack trace:
> 
> Unable to handle kernel NULL pointer dereference at virtual address 00000000
> PC is at dsa_slave_changeupper+0x5c/0x158
> 
>   dsa_slave_changeupper from raw_notifier_call_chain+0x38/0x6c
>   raw_notifier_call_chain from __netdev_upper_dev_link+0x198/0x3b4
>   __netdev_upper_dev_link from netdev_master_upper_dev_link+0x50/0x78
>   netdev_master_upper_dev_link from br_add_if+0x430/0x7f4
>   br_add_if from br_ioctl_stub+0x170/0x530
>   br_ioctl_stub from br_ioctl_call+0x54/0x7c
>   br_ioctl_call from dev_ifsioc+0x4e0/0x6bc
>   dev_ifsioc from dev_ioctl+0x2f8/0x758
>   dev_ioctl from sock_ioctl+0x5f0/0x674
>   sock_ioctl from sys_ioctl+0x518/0xe40
>   sys_ioctl from ret_fast_syscall+0x0/0x1c
> 
> Fix the problem by only overriding the extack if non-NULL.
> 
> Fixes: 1c6e8088d9a7 ("net: dsa: allow port_bridge_join() to override extack message")
> Link: https://lore.kernel.org/netdev/CABikg9wx7vB5eRDAYtvAm7fprJ09Ta27a4ZazC=NX5K4wn6pWA@mail.gmail.com/
> Reported-by: Sergei Antonov <saproj@...il.com>
> Signed-off-by: Vladimir Oltean <vladimir.oltean@....com>

Reviewed-by: Florian Fainelli <f.fainelli@...il.com>
-- 
Florian