netdev - Re: [PATCH net] net: mpls: fix stale pointer if allocation fails during device rename

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 15 Feb 2023 14:29:33 +0800
From:   Gong Ruiqi <gongruiqi1@...wei.com>
To:     Jakub Kicinski <kuba@...nel.org>
CC:     <davem@...emloft.net>, <netdev@...r.kernel.org>,
        <edumazet@...gle.com>, <pabeni@...hat.com>,
        lianhui tang <bluetlh@...il.com>, <kuniyu@...zon.co.jp>,
        <rshearma@...cade.com>
Subject: Re: [PATCH net] net: mpls: fix stale pointer if allocation fails
 during device rename



On 2023/02/15 5:23, Jakub Kicinski wrote:
> On Tue, 14 Feb 2023 17:33:36 +0800 Gong Ruiqi wrote:
>> Just be curious: would this be a simpler solution?
>>
>> @@ -1439,6 +1439,7 @@ static void mpls_dev_sysctl_unregister(struct
>> net_device *dev,
>>
>>         table = mdev->sysctl->ctl_table_arg;
>>         unregister_net_sysctl_table(mdev->sysctl);
>> +       mdev->sysctl = NULL;
>>         kfree(table);
>>
>>         mpls_netconf_notify_devconf(net, RTM_DELNETCONF, 0, mdev);
>>
>> However I'm not sure if we need to preserve the old value of
>> mdev->sysctl after we unregister it.
> 
> It'd work too, I decided to limit the zeroing to the exception case
> because of recent discussions on the list. The argument there was that
> zeroing in cases were we don't expect it to be necessary may hide bugs.
> We generally try to avoid defensive programming in the kernel.

Actually my original thought was not to do defensive programming, but to
clearly mark it as invalid after its de-registration. Nevertheless "to
avoid defensive programming in the kernel" is a good point :)

And oops, for my proposal the complete solution should be:

@@ -1437,8 +1437,12 @@ static void mpls_dev_sysctl_unregister(struct
net_device *dev,
        struct net *net = dev_net(dev);
        struct ctl_table *table;

+       if (!mdev->sysctl)
+               return;
+
        table = mdev->sysctl->ctl_table_arg;
        unregister_net_sysctl_table(mdev->sysctl);
+       mdev->sysctl = NULL;
        kfree(table);

        mpls_netconf_notify_devconf(net, RTM_DELNETCONF, 0, mdev);

to avoid NULL dereference at `table = mdev->sysctl->...` if we try to
unregister the device after a failed renaming. Then it looks really
similar with your patch xD. So yeah I'm ok with both of them.