All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
	Jiri Pirko <jiri@nvidia.com>, Jakub Kicinski <kuba@kernel.org>
Subject: [PATCH 5.10 22/25] rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()
Date: Fri,  4 Feb 2022 10:20:29 +0100	[thread overview]
Message-ID: <20220204091914.991840217@linuxfoundation.org> (raw)
In-Reply-To: <20220204091914.280602669@linuxfoundation.org>

From: Eric Dumazet <edumazet@google.com>

commit c6f6f2444bdbe0079e41914a35081530d0409963 upstream.

While looking at one unrelated syzbot bug, I found the replay logic
in __rtnl_newlink() to potentially trigger use-after-free.

It is better to clear master_dev and m_ops inside the loop,
in case we have to replay it.

Fixes: ba7d49b1f0f8 ("rtnetlink: provide api for getting and setting slave info")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jiri Pirko <jiri@nvidia.com>
Link: https://lore.kernel.org/r/20220201012106.216495-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/rtnetlink.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -3238,8 +3238,8 @@ static int __rtnl_newlink(struct sk_buff
 	struct nlattr *slave_attr[RTNL_SLAVE_MAX_TYPE + 1];
 	unsigned char name_assign_type = NET_NAME_USER;
 	struct nlattr *linkinfo[IFLA_INFO_MAX + 1];
-	const struct rtnl_link_ops *m_ops = NULL;
-	struct net_device *master_dev = NULL;
+	const struct rtnl_link_ops *m_ops;
+	struct net_device *master_dev;
 	struct net *net = sock_net(skb->sk);
 	const struct rtnl_link_ops *ops;
 	struct nlattr *tb[IFLA_MAX + 1];
@@ -3277,6 +3277,8 @@ replay:
 	else
 		dev = NULL;
 
+	master_dev = NULL;
+	m_ops = NULL;
 	if (dev) {
 		master_dev = netdev_master_upper_dev_get(dev);
 		if (master_dev)



  parent reply	other threads:[~2022-02-04  9:22 UTC|newest]

Thread overview: 42+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-02-04  9:20 [PATCH 5.10 00/25] 5.10.97-rc1 review Greg Kroah-Hartman
2022-02-04  9:20 ` [PATCH 5.10 01/25] PCI: pciehp: Fix infinite loop in IRQ handler upon power fault Greg Kroah-Hartman
2022-02-04  9:20 ` [PATCH 5.10 02/25] net: ipa: fix atomic update in ipa_endpoint_replenish() Greg Kroah-Hartman
2022-02-04  9:20 ` [PATCH 5.10 03/25] net: ipa: use a bitmap for endpoint replenish_enabled Greg Kroah-Hartman
2022-02-04  9:20 ` [PATCH 5.10 04/25] net: ipa: prevent concurrent replenish Greg Kroah-Hartman
2022-02-04  9:20 ` [PATCH 5.10 05/25] Revert "drivers: bus: simple-pm-bus: Add support for probing simple bus only devices" Greg Kroah-Hartman
2022-02-04  9:20 ` [PATCH 5.10 06/25] KVM: x86: Forcibly leave nested virt when SMM state is toggled Greg Kroah-Hartman
2022-02-04  9:20 ` [PATCH 5.10 07/25] psi: Fix uaf issue when psi trigger is destroyed while being polled Greg Kroah-Hartman
2022-02-04  9:20 ` [PATCH 5.10 08/25] perf: Rework perf_event_exit_event() Greg Kroah-Hartman
2022-02-04  9:37   ` Pavel Machek
2022-02-04  9:40     ` Greg Kroah-Hartman
2022-02-04 10:12       ` Pavel Machek
2022-02-05 10:25         ` Greg Kroah-Hartman
2022-02-04  9:20 ` [PATCH 5.10 09/25] perf/core: Fix cgroup event list management Greg Kroah-Hartman
2022-02-04  9:20 ` [PATCH 5.10 10/25] x86/mce: Add Xeon Sapphire Rapids to list of CPUs that support PPIN Greg Kroah-Hartman
2022-02-04  9:20 ` [PATCH 5.10 11/25] x86/cpu: Add Xeon Icelake-D " Greg Kroah-Hartman
2022-02-04  9:20 ` [PATCH 5.10 12/25] drm/vc4: hdmi: Make sure the device is powered with CEC Greg Kroah-Hartman
2022-02-05 11:40   ` Alexey Khoroshilov
2022-02-05 11:53     ` Greg Kroah-Hartman
2022-02-05 12:04       ` Alexey Khoroshilov
2022-02-04  9:20 ` [PATCH 5.10 13/25] cgroup-v1: Require capabilities to set release_agent Greg Kroah-Hartman
2022-02-04  9:20 ` [PATCH 5.10 14/25] net/mlx5e: Fix handling of wrong devices during bond netevent Greg Kroah-Hartman
2022-02-04  9:20 ` [PATCH 5.10 15/25] net/mlx5: Use del_timer_sync in fw reset flow of halting poll Greg Kroah-Hartman
2022-02-04  9:20 ` [PATCH 5.10 16/25] net/mlx5: E-Switch, Fix uninitialized variable modact Greg Kroah-Hartman
2022-02-04  9:20 ` [PATCH 5.10 17/25] ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback Greg Kroah-Hartman
2022-02-04  9:20 ` [PATCH 5.10 18/25] net: amd-xgbe: ensure to reset the tx_timer_active flag Greg Kroah-Hartman
2022-02-04  9:20 ` [PATCH 5.10 19/25] net: amd-xgbe: Fix skb data length underflow Greg Kroah-Hartman
2022-02-04  9:20 ` [PATCH 5.10 20/25] fanotify: Fix stale file descriptor in copy_event_to_user() Greg Kroah-Hartman
2022-02-04  9:20 ` [PATCH 5.10 21/25] net: sched: fix use-after-free in tc_new_tfilter() Greg Kroah-Hartman
2022-02-04  9:20 ` Greg Kroah-Hartman [this message]
2022-02-04  9:20 ` [PATCH 5.10 23/25] cpuset: Fix the bug that subpart_cpus updated wrongly in update_cpumask() Greg Kroah-Hartman
2022-02-04  9:20 ` [PATCH 5.10 24/25] af_packet: fix data-race in packet_setsockopt / packet_setsockopt Greg Kroah-Hartman
2022-02-04  9:20 ` [PATCH 5.10 25/25] tcp: add missing tcp_skb_can_collapse() test in tcp_shift_skb_data() Greg Kroah-Hartman
2022-02-04 11:31 ` [PATCH 5.10 00/25] 5.10.97-rc1 review Pavel Machek
2022-02-04 15:20 ` Jon Hunter
2022-02-04 17:33 ` Florian Fainelli
2022-02-04 19:11 ` Fox Chen
2022-02-04 20:32 ` Shuah Khan
2022-02-04 21:08 ` Guenter Roeck
2022-02-04 23:30 ` Slade Watkins
2022-02-05  7:01 ` Naresh Kamboju
2022-02-05 14:30 ` Sudip Mukherjee

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220204091914.991840217@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=edumazet@google.com \
    --cc=jiri@nvidia.com \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.