netdev - [PATCH] net-sysfs: fix NULL pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250305235307.14829-1-qasdev00@gmail.com>
Date: Wed,  5 Mar 2025 23:53:07 +0000
From: Qasim Ijaz <qasdev00@...il.com>
To: davem@...emloft.net,
	edumazet@...gle.com,
	kuba@...nel.org,
	pabeni@...hat.com,
	horms@...nel.org,
	atenart@...nel.org,
	jdamato@...tly.com,
	aleksander.lobakin@...el.com
Cc: netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH] net-sysfs: fix NULL pointer dereference

Commit <79c61899b5ee> introduces a potential NULL pointer dereference 
in the sysfs_rtnl_lock() function when initialising kn:

	kn = sysfs_break_active_protection(kobj, attr);

The commit overlooks the fact that sysfs_break_active_protection can 
return NULL if kernfs_find_and_get() fails to find and get the kernfs_node 
with the given name. 

Later on the code calls sysfs_unbreak_active_protection(kn) 
unconditionally, which could lead to a NULL pointer dereference.

Resolve this bug by introducing a NULL check before using kn
in the sysfs_unbreak_active_protection() call.

Signed-off-by: Qasim Ijaz <qasdev00@...il.com>
Fixes: 79c61899b5ee ("net-sysfs: remove rtnl_trylock from device attributes")
---
 net/core/net-sysfs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 8d9dc048a548..c5085588e536 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -117,7 +117,8 @@ static int sysfs_rtnl_lock(struct kobject *kobj, struct attribute *attr,
 	 * the rtnl lock.
 	 */
 unbreak:
-	sysfs_unbreak_active_protection(kn);
+	if (kn)
+		sysfs_unbreak_active_protection(kn);
 	dev_put(ndev);

 	return ret;
-- 
2.39.5