netdev - [PATCH net-next] net/ethtool: fix general protection fault in ethnl_set_plca

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230116065230.3438932-1-shaozhengchao@huawei.com>
Date:   Mon, 16 Jan 2023 14:52:30 +0800
From:   Zhengchao Shao <shaozhengchao@...wei.com>
To:     <netdev@...r.kernel.org>, <piergiorgio.beruto@...il.com>,
        <davem@...emloft.net>, <edumazet@...gle.com>, <kuba@...nel.org>,
        <pabeni@...hat.com>
CC:     <andrew@...n.ch>, <syzkaller-bugs@...glegroups.com>,
        <weiyongjun1@...wei.com>, <yuehaibing@...wei.com>,
        <shaozhengchao@...wei.com>
Subject: [PATCH net-next] net/ethtool: fix general protection fault in ethnl_set_plca_cfg()

As indicated by the ethnl_parse_header_dev_get() comment, return: 0 on
success or negative error code. ethnl_parse_header_dev_get() is
incorrectly used in ethnl_set_plca_cfg(). As a result, members in dev
are still accessed when dev is not obtained, resulting in a general
protection fault issue.

The stack information is as follows:
general protection fault, probably for non-canonical address
0xdffffc0000000173: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000b98-0x0000000000000b9f]
RIP: 0010:ethnl_set_plca_cfg+0x1be/0x7d0
Call Trace:
<TASK>
genl_family_rcv_msg_doit.isra.0+0x1d3/0x2c0
genl_rcv_msg+0x440/0x6e0
netlink_rcv_skb+0x140/0x3c0
genl_rcv+0x29/0x40
netlink_unicast+0x4a7/0x740
netlink_sendmsg+0x844/0xcf0
sock_sendmsg+0xca/0x110
____sys_sendmsg+0x588/0x6a0
___sys_sendmsg+0xed/0x170
__sys_sendmsg+0xc4/0x170
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
</TASK>

Reported-by: syzbot+8cf35743af243e5f417e@...kaller.appspotmail.com
Fixes: 8580e16c28f3 ("net/ethtool: add netlink interface for the PLCA RS")
Signed-off-by: Zhengchao Shao <shaozhengchao@...wei.com>
---
 net/ethtool/plca.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ethtool/plca.c b/net/ethtool/plca.c
index d9bb13ffc654..d030cfc64b1f 100644
--- a/net/ethtool/plca.c
+++ b/net/ethtool/plca.c
@@ -151,7 +151,7 @@ int ethnl_set_plca_cfg(struct sk_buff *skb, struct genl_info *info)
 					 tb[ETHTOOL_A_PLCA_HEADER],
 					 genl_info_net(info), info->extack,
 					 true);
-	if (!ret)
+	if (ret)
 		return ret;
 
 	dev = req_info.dev;
-- 
2.34.1