[PATCH] rtnetlink: Fix an error handling path in rtnl_newlink()

[PATCH] rtnetlink: Fix an error handling path in rtnl_newlink()

[Christophe JAILLET]

When some code has been moved in the commit in Fixes, some "return err;"
have correctly been changed in goto <some_where_in_the_error_handling_path>
but this one was missed.

Should "ops->maxtype > RTNL_MAX_TYPE" happen, then some resources would
leak.

Go through the error handling path to fix these leaks.

Fixes: 0d3008d1a9ae ("rtnetlink: Move ops->validate to rtnl_newlink().")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
---
Compile tested only
---
 net/core/rtnetlink.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 194a81e5f608..e269fae2b579 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -3829,8 +3829,10 @@ static int rtnl_newlink(struct sk_buff *skb, struct nlmsghdr *nlh,
 	}
 
 	if (ops) {
-		if (ops->maxtype > RTNL_MAX_TYPE)
-			return -EINVAL;
+		if (ops->maxtype > RTNL_MAX_TYPE) {
+			ret = -EINVAL;
+			goto put_ops;
+		}
 
 		if (ops->maxtype && linkinfo[IFLA_INFO_DATA]) {
 			ret = nla_parse_nested_deprecated(tbs->attr, ops->maxtype,
-- 
2.47.0

[PATCH] rtnetlink: Fix an error handling path in rtnl_newlink()

[Christophe JAILLET]

All error handling paths go to "out", except this one. Before the commit in
Fixes, error in the previous code would also end to "out".

So, go to "out" also in this case to free some resources before returning.

Fixes: 62262dd00c31 ("wifi: cfg80211: disallow SMPS in AP mode")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
---
Compile tested only
---
 net/wireless/nl80211.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 1ac8a196f376..d9cc33474b85 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -6273,8 +6273,10 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
 	}
 
 	if (info->attrs[NL80211_ATTR_SMPS_MODE] &&
-	    nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]) != NL80211_SMPS_OFF)
-		return -EOPNOTSUPP;
+	    nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]) != NL80211_SMPS_OFF) {
+		err = -EOPNOTSUPP;
+		goto out;
+	}
 
 	params->pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
 	if (params->pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
-- 
2.47.0

Re: [PATCH] rtnetlink: Fix an error handling path in rtnl_newlink()

[Kuniyuki Iwashima]

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sat, 26 Oct 2024 16:17:44 +0200
> When some code has been moved in the commit in Fixes, some "return err;"
> have correctly been changed in goto <some_where_in_the_error_handling_path>
> but this one was missed.
> 
> Should "ops->maxtype > RTNL_MAX_TYPE" happen, then some resources would
> leak.
> 
> Go through the error handling path to fix these leaks.
> 
> Fixes: 0d3008d1a9ae ("rtnetlink: Move ops->validate to rtnl_newlink().")
> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>

Thanks for catching!

> ---
> Compile tested only
> ---
>  net/core/rtnetlink.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
> index 194a81e5f608..e269fae2b579 100644
> --- a/net/core/rtnetlink.c
> +++ b/net/core/rtnetlink.c
> @@ -3829,8 +3829,10 @@ static int rtnl_newlink(struct sk_buff *skb, struct nlmsghdr *nlh,
>  	}
>  
>  	if (ops) {
> -		if (ops->maxtype > RTNL_MAX_TYPE)
> -			return -EINVAL;
> +		if (ops->maxtype > RTNL_MAX_TYPE) {
> +			ret = -EINVAL;
> +			goto put_ops;
> +		}
>  
>  		if (ops->maxtype && linkinfo[IFLA_INFO_DATA]) {
>  			ret = nla_parse_nested_deprecated(tbs->attr, ops->maxtype,
> -- 
> 2.47.0

Re: [PATCH] rtnetlink: Fix an error handling path in rtnl_newlink()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Sat, 26 Oct 2024 16:17:44 +0200 you wrote:
> When some code has been moved in the commit in Fixes, some "return err;"
> have correctly been changed in goto <some_where_in_the_error_handling_path>
> but this one was missed.
> 
> Should "ops->maxtype > RTNL_MAX_TYPE" happen, then some resources would
> leak.
> 
> [...]

Here is the summary with links:
  - rtnetlink: Fix an error handling path in rtnl_newlink()
    https://git.kernel.org/netdev/net-next/c/bd03e7627c37

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html