From patchwork Mon Nov 9 12:30:54 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michal Kubecek X-Patchwork-Id: 11891443 X-Patchwork-Delegate: mkubecek+ethtool@suse.cz Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2BA32C388F7 for ; Mon, 9 Nov 2020 12:30:57 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D92E42083B for ; Mon, 9 Nov 2020 12:30:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729629AbgKIMaz (ORCPT ); Mon, 9 Nov 2020 07:30:55 -0500 Received: from mx2.suse.de ([195.135.220.15]:41022 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727826AbgKIMaz (ORCPT ); Mon, 9 Nov 2020 07:30:55 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id 6E416ABDE; Mon, 9 Nov 2020 12:30:54 +0000 (UTC) Received: by lion.mk-sys.cz (Postfix, from userid 1000) id 39E9560344; Mon, 9 Nov 2020 13:30:54 +0100 (CET) Message-Id: <2f9ce041168369105b3734aa3ff6f08bb5600620.1604924742.git.mkubecek@suse.cz> In-Reply-To: References: From: Michal Kubecek Subject: [PATCH ethtool 1/2] netlink: fix use after free in netlink_run_handler() To: netdev@vger.kernel.org Cc: Ido Schimmel , Ivan Vecera Date: Mon, 9 Nov 2020 13:30:54 +0100 (CET) Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: mkubecek+ethtool@suse.cz Valgrind detected use after free in netlink_run_handler(): some members of struct nl_context are accessed after the netlink context is freed by netlink_done(). Use local variables to store the two flags and check them instead. Fixes: 6c19c0d559c8 ("netlink: use genetlink ops information to decide about fallback") Signed-off-by: Michal Kubecek --- netlink/netlink.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/netlink/netlink.c b/netlink/netlink.c index f655f6ea25b7..aaaabdd3048e 100644 --- a/netlink/netlink.c +++ b/netlink/netlink.c @@ -457,6 +457,7 @@ void netlink_run_handler(struct cmd_context *ctx, nl_func_t nlfunc, bool no_fallback) { bool wildcard = ctx->devname && !strcmp(ctx->devname, WILDCARD_DEVNAME); + bool wildcard_unsupported, ioctl_fallback; struct nl_context *nlctx; const char *reason; int ret; @@ -478,14 +479,17 @@ void netlink_run_handler(struct cmd_context *ctx, nl_func_t nlfunc, nlctx = ctx->nlctx; ret = nlfunc(ctx); + wildcard_unsupported = nlctx->wildcard_unsupported; + ioctl_fallback = nlctx->ioctl_fallback; netlink_done(ctx); - if (no_fallback || ret != -EOPNOTSUPP || !nlctx->ioctl_fallback) { - if (nlctx->wildcard_unsupported) + + if (no_fallback || ret != -EOPNOTSUPP || !ioctl_fallback) { + if (wildcard_unsupported) fprintf(stderr, "%s\n", "subcommand does not support wildcard dump"); exit(ret >= 0 ? ret : 1); } - if (nlctx->wildcard_unsupported) + if (wildcard_unsupported) reason = "subcommand does not support wildcard dump"; else reason = "kernel netlink support for subcommand missing";