From patchwork Mon Jan 16 06:52:30 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: shaozhengchao X-Patchwork-Id: 13102666 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 37856C54EBE for ; Mon, 16 Jan 2023 06:43:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231861AbjAPGnd (ORCPT ); Mon, 16 Jan 2023 01:43:33 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33874 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231910AbjAPGnc (ORCPT ); Mon, 16 Jan 2023 01:43:32 -0500 Received: from szxga08-in.huawei.com (szxga08-in.huawei.com [45.249.212.255]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B47494495 for ; Sun, 15 Jan 2023 22:43:30 -0800 (PST) Received: from dggpeml500026.china.huawei.com (unknown [172.30.72.57]) by szxga08-in.huawei.com (SkyGuard) with ESMTP id 4NwMr94dYTz16Mk1; Mon, 16 Jan 2023 14:41:45 +0800 (CST) Received: from huawei.com (10.175.101.6) by dggpeml500026.china.huawei.com (7.185.36.106) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.34; Mon, 16 Jan 2023 14:43:26 +0800 From: Zhengchao Shao To: , , , , , CC: , , , , Subject: [PATCH net-next] net/ethtool: fix general protection fault in ethnl_set_plca_cfg() Date: Mon, 16 Jan 2023 14:52:30 +0800 Message-ID: <20230116065230.3438932-1-shaozhengchao@huawei.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Originating-IP: [10.175.101.6] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpeml500026.china.huawei.com (7.185.36.106) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org As indicated by the ethnl_parse_header_dev_get() comment, return: 0 on success or negative error code. ethnl_parse_header_dev_get() is incorrectly used in ethnl_set_plca_cfg(). As a result, members in dev are still accessed when dev is not obtained, resulting in a general protection fault issue. The stack information is as follows: general protection fault, probably for non-canonical address 0xdffffc0000000173: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000b98-0x0000000000000b9f] RIP: 0010:ethnl_set_plca_cfg+0x1be/0x7d0 Call Trace: genl_family_rcv_msg_doit.isra.0+0x1d3/0x2c0 genl_rcv_msg+0x440/0x6e0 netlink_rcv_skb+0x140/0x3c0 genl_rcv+0x29/0x40 netlink_unicast+0x4a7/0x740 netlink_sendmsg+0x844/0xcf0 sock_sendmsg+0xca/0x110 ____sys_sendmsg+0x588/0x6a0 ___sys_sendmsg+0xed/0x170 __sys_sendmsg+0xc4/0x170 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Reported-by: syzbot+8cf35743af243e5f417e@syzkaller.appspotmail.com Fixes: 8580e16c28f3 ("net/ethtool: add netlink interface for the PLCA RS") Signed-off-by: Zhengchao Shao --- net/ethtool/plca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ethtool/plca.c b/net/ethtool/plca.c index d9bb13ffc654..d030cfc64b1f 100644 --- a/net/ethtool/plca.c +++ b/net/ethtool/plca.c @@ -151,7 +151,7 @@ int ethnl_set_plca_cfg(struct sk_buff *skb, struct genl_info *info) tb[ETHTOOL_A_PLCA_HEADER], genl_info_net(info), info->extack, true); - if (!ret) + if (ret) return ret; dev = req_info.dev;