netdev - Re: [Patch net] rtnetlink: catch error pointer for rtnl_link_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241129073609.30713-1-kuniyu@amazon.com>
Date: Fri, 29 Nov 2024 16:36:09 +0900
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <xiyou.wangcong@...il.com>
CC: <cong.wang@...edance.com>, <kuniyu@...zon.com>, <netdev@...r.kernel.org>,
	<syzbot+21ba4d5adff0b6a7cfc6@...kaller.appspotmail.com>
Subject: Re: [Patch net] rtnetlink: catch error pointer for rtnl_link_get_net()

From: Cong Wang <xiyou.wangcong@...il.com>
Date: Thu, 28 Nov 2024 22:31:12 -0800
> From: Cong Wang <cong.wang@...edance.com>
> 
> Currently all callers of rtnl_link_get_net() assume that it always
> returns a valid netns pointer,

because I assume it's always tested in rtnl_add_peer_net()...


> when rtnl_link_get_net_ifla() fails,
> it uses 'src_net' as a fallback.
> 
> This is not true,

because rtnl_link_get_net_ifla() isn't called if (!data ||
!data[ops->peer_type]),

so the correct fix is:

---8<---
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index dd142f444659..c1f4aaa40823 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -3815,6 +3815,10 @@ static int rtnl_add_peer_net(struct rtnl_nets *rtnl_nets,
 	struct net *net;
 	int err;
 
+	net = rtnl_link_get_net_ifla(tb);
+	if (IS_ERR(net))
+		return PTR_ERR(net);
+
 	if (!data || !data[ops->peer_type])
 		return 0;
 
@@ -3828,9 +3832,6 @@ static int rtnl_add_peer_net(struct rtnl_nets *rtnl_nets,
 			return err;
 	}
 
-	net = rtnl_link_get_net_ifla(tb);
-	if (IS_ERR(net))
-		return PTR_ERR(net);
 	if (net)
 		rtnl_nets_add(rtnl_nets, net);
 
---8<---


> because rtnl_link_get_net_ifla() can return an
> error pointer too, we need to handle this error case and propagate
> the error code to its callers.
> 
> Add a comment to better document its return value.