| Message ID | 20250305235307.14829-1-qasdev00@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | net-sysfs: fix NULL pointer dereference | expand |
Quoting Qasim Ijaz (2025-03-06 00:53:07) > Commit <79c61899b5ee> introduces a potential NULL pointer dereference > in the sysfs_rtnl_lock() function when initialising kn: > > kn = sysfs_break_active_protection(kobj, attr); > > The commit overlooks the fact that sysfs_break_active_protection can > return NULL if kernfs_find_and_get() fails to find and get the kernfs_node > with the given name. If it fails to get it, should we let sysfs_rtnl_lock continue is execution? > Later on the code calls sysfs_unbreak_active_protection(kn) > unconditionally, which could lead to a NULL pointer dereference. > > Resolve this bug by introducing a NULL check before using kn > in the sysfs_unbreak_active_protection() call. Did you see this in practice? Can you describe what led to this? Thanks! Antoine > Signed-off-by: Qasim Ijaz <qasdev00@gmail.com> > Fixes: 79c61899b5ee ("net-sysfs: remove rtnl_trylock from device attributes") > --- > net/core/net-sysfs.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c > index 8d9dc048a548..c5085588e536 100644 > --- a/net/core/net-sysfs.c > +++ b/net/core/net-sysfs.c > @@ -117,7 +117,8 @@ static int sysfs_rtnl_lock(struct kobject *kobj, struct attribute *attr, > * the rtnl lock. > */ > unbreak: > - sysfs_unbreak_active_protection(kn); > + if (kn) > + sysfs_unbreak_active_protection(kn); > dev_put(ndev); > > return ret; > -- > 2.39.5 > >
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c index 8d9dc048a548..c5085588e536 100644 --- a/net/core/net-sysfs.c +++ b/net/core/net-sysfs.c @@ -117,7 +117,8 @@ static int sysfs_rtnl_lock(struct kobject *kobj, struct attribute *attr, * the rtnl lock. */ unbreak: - sysfs_unbreak_active_protection(kn); + if (kn) + sysfs_unbreak_active_protection(kn); dev_put(ndev); return ret;
Commit <79c61899b5ee> introduces a potential NULL pointer dereference in the sysfs_rtnl_lock() function when initialising kn: kn = sysfs_break_active_protection(kobj, attr); The commit overlooks the fact that sysfs_break_active_protection can return NULL if kernfs_find_and_get() fails to find and get the kernfs_node with the given name. Later on the code calls sysfs_unbreak_active_protection(kn) unconditionally, which could lead to a NULL pointer dereference. Resolve this bug by introducing a NULL check before using kn in the sysfs_unbreak_active_protection() call. Signed-off-by: Qasim Ijaz <qasdev00@gmail.com> Fixes: 79c61899b5ee ("net-sysfs: remove rtnl_trylock from device attributes") --- net/core/net-sysfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)