| Message ID | 20230116065230.3438932-1-shaozhengchao@huawei.com (mailing list archive) |
|---|---|
| State | Not Applicable |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net-next] net/ethtool: fix general protection fault in ethnl_set_plca_cfg() | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Clearly marked for net-next |
| netdev/apply | fail | Patch does not apply to net-next |
Please igonre this patch. Issue has been solved in https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=28dbf774bc879c1841d58cb711aaea6198955b95. On 2023/1/16 14:52, Zhengchao Shao wrote: > As indicated by the ethnl_parse_header_dev_get() comment, return: 0 on > success or negative error code. ethnl_parse_header_dev_get() is > incorrectly used in ethnl_set_plca_cfg(). As a result, members in dev > are still accessed when dev is not obtained, resulting in a general > protection fault issue. > > The stack information is as follows: > general protection fault, probably for non-canonical address > 0xdffffc0000000173: 0000 [#1] PREEMPT SMP KASAN > KASAN: null-ptr-deref in range [0x0000000000000b98-0x0000000000000b9f] > RIP: 0010:ethnl_set_plca_cfg+0x1be/0x7d0 > Call Trace: > <TASK> > genl_family_rcv_msg_doit.isra.0+0x1d3/0x2c0 > genl_rcv_msg+0x440/0x6e0 > netlink_rcv_skb+0x140/0x3c0 > genl_rcv+0x29/0x40 > netlink_unicast+0x4a7/0x740 > netlink_sendmsg+0x844/0xcf0 > sock_sendmsg+0xca/0x110 > ____sys_sendmsg+0x588/0x6a0 > ___sys_sendmsg+0xed/0x170 > __sys_sendmsg+0xc4/0x170 > do_syscall_64+0x35/0x80 > entry_SYSCALL_64_after_hwframe+0x46/0xb0 > </TASK> > > Reported-by: syzbot+8cf35743af243e5f417e@syzkaller.appspotmail.com > Fixes: 8580e16c28f3 ("net/ethtool: add netlink interface for the PLCA RS") > Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com> > --- > net/ethtool/plca.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/ethtool/plca.c b/net/ethtool/plca.c > index d9bb13ffc654..d030cfc64b1f 100644 > --- a/net/ethtool/plca.c > +++ b/net/ethtool/plca.c > @@ -151,7 +151,7 @@ int ethnl_set_plca_cfg(struct sk_buff *skb, struct genl_info *info) > tb[ETHTOOL_A_PLCA_HEADER], > genl_info_net(info), info->extack, > true); > - if (!ret) > + if (ret) > return ret; > > dev = req_info.dev;
diff --git a/net/ethtool/plca.c b/net/ethtool/plca.c index d9bb13ffc654..d030cfc64b1f 100644 --- a/net/ethtool/plca.c +++ b/net/ethtool/plca.c @@ -151,7 +151,7 @@ int ethnl_set_plca_cfg(struct sk_buff *skb, struct genl_info *info) tb[ETHTOOL_A_PLCA_HEADER], genl_info_net(info), info->extack, true); - if (!ret) + if (ret) return ret; dev = req_info.dev;
As indicated by the ethnl_parse_header_dev_get() comment, return: 0 on success or negative error code. ethnl_parse_header_dev_get() is incorrectly used in ethnl_set_plca_cfg(). As a result, members in dev are still accessed when dev is not obtained, resulting in a general protection fault issue. The stack information is as follows: general protection fault, probably for non-canonical address 0xdffffc0000000173: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000b98-0x0000000000000b9f] RIP: 0010:ethnl_set_plca_cfg+0x1be/0x7d0 Call Trace: <TASK> genl_family_rcv_msg_doit.isra.0+0x1d3/0x2c0 genl_rcv_msg+0x440/0x6e0 netlink_rcv_skb+0x140/0x3c0 genl_rcv+0x29/0x40 netlink_unicast+0x4a7/0x740 netlink_sendmsg+0x844/0xcf0 sock_sendmsg+0xca/0x110 ____sys_sendmsg+0x588/0x6a0 ___sys_sendmsg+0xed/0x170 __sys_sendmsg+0xc4/0x170 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> Reported-by: syzbot+8cf35743af243e5f417e@syzkaller.appspotmail.com Fixes: 8580e16c28f3 ("net/ethtool: add netlink interface for the PLCA RS") Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com> --- net/ethtool/plca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)