From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
syzbot+f9f76f4a0766420b4a02@syzkaller.appspotmail.com,
Tadeusz Struk <tadeusz.struk@linaro.org>,
Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>,
Jakub Kicinski <kuba@kernel.org>
Subject: [PATCH 4.9 01/31] nfc: fix segfault in nfc_genl_dump_devices_done
Date: Mon, 20 Dec 2021 15:34:01 +0100 [thread overview]
Message-ID: <20211220143020.031915064@linuxfoundation.org> (raw)
In-Reply-To: <20211220143019.974513085@linuxfoundation.org>
From: Tadeusz Struk <tadeusz.struk@linaro.org>
commit fd79a0cbf0b2e34bcc45b13acf962e2032a82203 upstream.
When kmalloc in nfc_genl_dump_devices() fails then
nfc_genl_dump_devices_done() segfaults as below
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 25 Comm: kworker/0:1 Not tainted 5.16.0-rc4-01180-g2a987e65025e-dirty #5
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-6.fc35 04/01/2014
Workqueue: events netlink_sock_destruct_work
RIP: 0010:klist_iter_exit+0x26/0x80
Call Trace:
<TASK>
class_dev_iter_exit+0x15/0x20
nfc_genl_dump_devices_done+0x3b/0x50
genl_lock_done+0x84/0xd0
netlink_sock_destruct+0x8f/0x270
__sk_destruct+0x64/0x3b0
sk_destruct+0xa8/0xd0
__sk_free+0x2e8/0x3d0
sk_free+0x51/0x90
netlink_sock_destruct_work+0x1c/0x20
process_one_work+0x411/0x710
worker_thread+0x6fd/0xa80
Link: https://syzkaller.appspot.com/bug?id=fc0fa5a53db9edd261d56e74325419faf18bd0df
Reported-by: syzbot+f9f76f4a0766420b4a02@syzkaller.appspotmail.com
Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Link: https://lore.kernel.org/r/20211208182742.340542-1-tadeusz.struk@linaro.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/nfc/netlink.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -669,8 +669,10 @@ static int nfc_genl_dump_devices_done(st
{
struct class_dev_iter *iter = (struct class_dev_iter *) cb->args[0];
- nfc_device_iter_exit(iter);
- kfree(iter);
+ if (iter) {
+ nfc_device_iter_exit(iter);
+ kfree(iter);
+ }
return 0;
}
next prev parent reply other threads:[~2021-12-20 14:37 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-20 14:34 [PATCH 4.9 00/31] 4.9.294-rc1 review Greg Kroah-Hartman
2021-12-20 14:34 ` Greg Kroah-Hartman [this message]
2021-12-20 14:34 ` [PATCH 4.9 02/31] net/mlx4_en: Update reported link modes for 1/10G Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 03/31] parisc/agp: Annotate parisc agp init functions with __init Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 04/31] i2c: rk3x: Handle a spurious start completion interrupt flag Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 05/31] net: netlink: af_netlink: Prevent empty skb by adding a check on len Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 06/31] tracing: Fix a kmemleak false positive in tracing_map Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 07/31] hwmon: (dell-smm) Fix warning on /proc/i8k creation error Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 08/31] mac80211: send ADDBA requests using the tid/queue of the aggregation session Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 09/31] recordmcount.pl: look for jgnop instruction as well as bcrl on s390 Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 10/31] dm btree remove: fix use after free in rebalance_children() Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 11/31] nfsd: fix use-after-free due to delegation race Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 12/31] soc/tegra: fuse: Fix bitwise vs. logical OR warning Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 13/31] igbvf: fix double free in `igbvf_probe` Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 14/31] ixgbe: set X550 MDIO speed before talking to PHY Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 15/31] USB: gadget: bRequestType is a bitfield, not a enum Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 16/31] PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 17/31] USB: serial: option: add Telit FN990 compositions Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 18/31] timekeeping: Really make sure wall_to_monotonic isnt positive Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 19/31] net: systemport: Add global locking for descriptor lifecycle Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 20/31] firmware: arm_scpi: Fix string overflow in SCPI genpd driver Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 21/31] fuse: annotate lock in fuse_reverse_inval_entry() Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 22/31] scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 23/31] net: lan78xx: Avoid unnecessary self assignment Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 24/31] ARM: 8805/2: remove unneeded naked function usage Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 25/31] mwifiex: Remove unnecessary braces from HostCmd_SET_SEQ_NO_BSS_INFO Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 26/31] Input: touchscreen - avoid bitwise vs logical OR warning Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 27/31] xen/blkfront: harden blkfront against event channel storms Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 28/31] xen/netfront: harden netfront " Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 29/31] xen/console: harden hvc_xen " Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 30/31] xen/netback: fix rx queue stall detection Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.9 31/31] xen/netback: dont queue unlimited number of packages Greg Kroah-Hartman
2021-12-20 17:22 ` [PATCH 4.9 00/31] 4.9.294-rc1 review Florian Fainelli
2021-12-20 23:19 ` Shuah Khan
2021-12-21 17:33 ` Naresh Kamboju
2021-12-21 23:12 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211220143020.031915064@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=krzysztof.kozlowski@canonical.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+f9f76f4a0766420b4a02@syzkaller.appspotmail.com \
--cc=tadeusz.struk@linaro.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox