netdev - Re: [PATCH] net-sysfs: fix NULL pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Z8w7ezFX3T01ptjH@qasdev.system>
Date: Sat, 8 Mar 2025 12:43:39 +0000
From: Qasim Ijaz <qasdev00@...il.com>
To: Antoine Tenart <atenart@...nel.org>
Cc: davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org,
	pabeni@...hat.com, horms@...nel.org, jdamato@...tly.com,
	aleksander.lobakin@...el.com, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] net-sysfs: fix NULL pointer dereference

On Thu, Mar 06, 2025 at 09:12:44AM +0100, Antoine Tenart wrote:
> Quoting Qasim Ijaz (2025-03-06 00:53:07)
> > Commit <79c61899b5ee> introduces a potential NULL pointer dereference 
> > in the sysfs_rtnl_lock() function when initialising kn:
> > 
> >         kn = sysfs_break_active_protection(kobj, attr);
> >         
> > The commit overlooks the fact that sysfs_break_active_protection can 
> > return NULL if kernfs_find_and_get() fails to find and get the kernfs_node 
> > with the given name. 
> 
> If it fails to get it, should we let sysfs_rtnl_lock continue is
> execution?

Hi Antoine, I think I may have misunderstood the code. Yes I do think it
would probably be better to end the function if
sysfs_break_active_protection fails. 

> 
> > Later on the code calls sysfs_unbreak_active_protection(kn) 
> > unconditionally, which could lead to a NULL pointer dereference.
> > 
> > Resolve this bug by introducing a NULL check before using kn
> > in the sysfs_unbreak_active_protection() call.
> 
> Did you see this in practice? Can you describe what led to this?

I have not seen this in practise but I think in terms of defensive
programming it could be a good addition to add a check to see if it
fails. If a function can return NULL then we should check for that, also
if we look at sysfs_break_active_protection being used throughout the
kernel there is multiple NULL checks so I think adding one here would be
handy. 

If you agree would you like me to send another patch where I check for
failure and end execution right away?

Thanks,
Qasim
> 
> Thanks!
> Antoine
> 
> > Signed-off-by: Qasim Ijaz <qasdev00@...il.com>
> > Fixes: 79c61899b5ee ("net-sysfs: remove rtnl_trylock from device attributes")
> > ---
> >  net/core/net-sysfs.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> > 
> > diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
> > index 8d9dc048a548..c5085588e536 100644
> > --- a/net/core/net-sysfs.c
> > +++ b/net/core/net-sysfs.c
> > @@ -117,7 +117,8 @@ static int sysfs_rtnl_lock(struct kobject *kobj, struct attribute *attr,
> >          * the rtnl lock.
> >          */
> >  unbreak:
> > -       sysfs_unbreak_active_protection(kn);
> > +       if (kn)
> > +               sysfs_unbreak_active_protection(kn);
> >         dev_put(ndev);
> >  
> >         return ret;
> > -- 
> > 2.39.5
> > 
> >
>