netdev - Re: [PATCH net] net: dsa: don't dereference NULL extack in dsa_slave

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CABikg9w5B4QDssS9sHZ_a3w1G-oeQQTkegyxK-hcgTHB-3155g@mail.gmail.com>
Date:   Sun, 21 Aug 2022 17:01:29 +0300
From:   Sergei Antonov <saproj@...il.com>
To:     Vladimir Oltean <vladimir.oltean@....com>
Cc:     netdev@...r.kernel.org, Andrew Lunn <andrew@...n.ch>,
        Vivien Didelot <vivien.didelot@...il.com>,
        Florian Fainelli <f.fainelli@...il.com>,
        Vladimir Oltean <olteanv@...il.com>,
        Clément Léger <clement.leger@...tlin.com>,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>
Subject: Re: [PATCH net] net: dsa: don't dereference NULL extack in dsa_slave_changeupper()

On Fri, 19 Aug 2022 at 20:39, Vladimir Oltean <vladimir.oltean@....com> wrote:
>
> When a driver returns -EOPNOTSUPP in dsa_port_bridge_join() but failed
> to provide a reason for it, DSA attempts to set the extack to say that
> software fallback will kick in.
>
> The problem is, when we use brctl and the legacy bridge ioctls, the
> extack will be NULL, and DSA dereferences it in the process of setting
> it.
>
> Sergei Antonov proves this using the following stack trace:
>
> Unable to handle kernel NULL pointer dereference at virtual address 00000000
> PC is at dsa_slave_changeupper+0x5c/0x158
>
>  dsa_slave_changeupper from raw_notifier_call_chain+0x38/0x6c
>  raw_notifier_call_chain from __netdev_upper_dev_link+0x198/0x3b4
>  __netdev_upper_dev_link from netdev_master_upper_dev_link+0x50/0x78
>  netdev_master_upper_dev_link from br_add_if+0x430/0x7f4
>  br_add_if from br_ioctl_stub+0x170/0x530
>  br_ioctl_stub from br_ioctl_call+0x54/0x7c
>  br_ioctl_call from dev_ifsioc+0x4e0/0x6bc
>  dev_ifsioc from dev_ioctl+0x2f8/0x758
>  dev_ioctl from sock_ioctl+0x5f0/0x674
>  sock_ioctl from sys_ioctl+0x518/0xe40
>  sys_ioctl from ret_fast_syscall+0x0/0x1c
>
> Fix the problem by only overriding the extack if non-NULL.
>
> Fixes: 1c6e8088d9a7 ("net: dsa: allow port_bridge_join() to override extack message")
> Link: https://lore.kernel.org/netdev/CABikg9wx7vB5eRDAYtvAm7fprJ09Ta27a4ZazC=NX5K4wn6pWA@mail.gmail.com/
> Reported-by: Sergei Antonov <saproj@...il.com>
> Signed-off-by: Vladimir Oltean <vladimir.oltean@....com>

Tested-by: Sergei Antonov <saproj@...il.com>