netdev - Re: [PATCH net-next] net: ethtool: use correct device pointer in ethnl_default_dump

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z8sPfRBBLWRGkyBH@mini-arch>
Date: Fri, 7 Mar 2025 07:23:41 -0800
From: Stanislav Fomichev <stfomichev@...il.com>
To: Eric Dumazet <edumazet@...gle.com>
Cc: "David S . Miller" <davem@...emloft.net>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Stanislav Fomichev <sdf@...ichev.me>,
	Simon Horman <horms@...nel.org>, netdev@...r.kernel.org,
	eric.dumazet@...il.com,
	syzbot+3da2442641f0c6a705a2@...kaller.appspotmail.com
Subject: Re: [PATCH net-next] net: ethtool: use correct device pointer in
 ethnl_default_dump_one()

On 03/07, Eric Dumazet wrote:
> ethnl_default_dump_one() operates on the device provided in its @dev
> parameter, not from ctx->req_info->dev.
> 
> syzbot reported:
> 
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000197: 0000 [#1] PREEMPT SMP KASAN PTI
> KASAN: null-ptr-deref in range [0x0000000000000cb8-0x0000000000000cbf]
>  RIP: 0010:netdev_need_ops_lock include/linux/netdevice.h:2792 [inline]
>  RIP: 0010:netdev_lock_ops include/linux/netdevice.h:2803 [inline]
>  RIP: 0010:ethnl_default_dump_one net/ethtool/netlink.c:557 [inline]
>  RIP: 0010:ethnl_default_dumpit+0x447/0xd40 net/ethtool/netlink.c:593
> Call Trace:
>  <TASK>
>   genl_dumpit+0x10d/0x1b0 net/netlink/genetlink.c:1027
>   netlink_dump+0x64d/0xe10 net/netlink/af_netlink.c:2309
>   __netlink_dump_start+0x5a2/0x790 net/netlink/af_netlink.c:2424
>   genl_family_rcv_msg_dumpit net/netlink/genetlink.c:1076 [inline]
>   genl_family_rcv_msg net/netlink/genetlink.c:1192 [inline]
>   genl_rcv_msg+0x894/0xec0 net/netlink/genetlink.c:1210
>   netlink_rcv_skb+0x206/0x480 net/netlink/af_netlink.c:2534
>   genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
>   netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
>   netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1339
>   netlink_sendmsg+0x8de/0xcb0 net/netlink/af_netlink.c:1883
>   sock_sendmsg_nosec net/socket.c:709 [inline]
>   __sock_sendmsg+0x221/0x270 net/socket.c:724
>   ____sys_sendmsg+0x53a/0x860 net/socket.c:2564
>   ___sys_sendmsg net/socket.c:2618 [inline]
>   __sys_sendmsg+0x269/0x350 net/socket.c:2650
> 
> Fixes: 2bcf4772e45a ("net: ethtool: try to protect all callback with netdev instance lock")
> Reported-by: syzbot+3da2442641f0c6a705a2@...kaller.appspotmail.com
> Closes: https://lore.kernel.org/lkml/67caaf5e.050a0220.15b4b9.007a.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>

Acked-by: Stanislav Fomichev <sdf@...ichev.me>