From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
syzbot+f9f76f4a0766420b4a02@syzkaller.appspotmail.com,
Tadeusz Struk <tadeusz.struk@linaro.org>,
Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>,
Jakub Kicinski <kuba@kernel.org>
Subject: [PATCH 4.14 01/45] nfc: fix segfault in nfc_genl_dump_devices_done
Date: Mon, 20 Dec 2021 15:33:56 +0100 [thread overview]
Message-ID: <20211220143022.315776376@linuxfoundation.org> (raw)
In-Reply-To: <20211220143022.266532675@linuxfoundation.org>
From: Tadeusz Struk <tadeusz.struk@linaro.org>
commit fd79a0cbf0b2e34bcc45b13acf962e2032a82203 upstream.
When kmalloc in nfc_genl_dump_devices() fails then
nfc_genl_dump_devices_done() segfaults as below
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 25 Comm: kworker/0:1 Not tainted 5.16.0-rc4-01180-g2a987e65025e-dirty #5
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-6.fc35 04/01/2014
Workqueue: events netlink_sock_destruct_work
RIP: 0010:klist_iter_exit+0x26/0x80
Call Trace:
<TASK>
class_dev_iter_exit+0x15/0x20
nfc_genl_dump_devices_done+0x3b/0x50
genl_lock_done+0x84/0xd0
netlink_sock_destruct+0x8f/0x270
__sk_destruct+0x64/0x3b0
sk_destruct+0xa8/0xd0
__sk_free+0x2e8/0x3d0
sk_free+0x51/0x90
netlink_sock_destruct_work+0x1c/0x20
process_one_work+0x411/0x710
worker_thread+0x6fd/0xa80
Link: https://syzkaller.appspot.com/bug?id=fc0fa5a53db9edd261d56e74325419faf18bd0df
Reported-by: syzbot+f9f76f4a0766420b4a02@syzkaller.appspotmail.com
Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Link: https://lore.kernel.org/r/20211208182742.340542-1-tadeusz.struk@linaro.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/nfc/netlink.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -666,8 +666,10 @@ static int nfc_genl_dump_devices_done(st
{
struct class_dev_iter *iter = (struct class_dev_iter *) cb->args[0];
- nfc_device_iter_exit(iter);
- kfree(iter);
+ if (iter) {
+ nfc_device_iter_exit(iter);
+ kfree(iter);
+ }
return 0;
}
next prev parent reply other threads:[~2021-12-20 14:39 UTC|newest]
Thread overview: 48+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-20 14:33 [PATCH 4.14 00/45] 4.14.259-rc1 review Greg Kroah-Hartman
2021-12-20 14:33 ` Greg Kroah-Hartman [this message]
2021-12-20 14:33 ` [PATCH 4.14 02/45] drm/msm/dsi: set default num_data_lanes Greg Kroah-Hartman
2021-12-20 14:33 ` [PATCH 4.14 03/45] net/mlx4_en: Update reported link modes for 1/10G Greg Kroah-Hartman
2021-12-20 14:33 ` [PATCH 4.14 04/45] parisc/agp: Annotate parisc agp init functions with __init Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 05/45] i2c: rk3x: Handle a spurious start completion interrupt flag Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 06/45] net: netlink: af_netlink: Prevent empty skb by adding a check on len Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 07/45] tracing: Fix a kmemleak false positive in tracing_map Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 08/45] bpf: fix panic due to oob in bpf_prog_test_run_skb Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 09/45] hwmon: (dell-smm) Fix warning on /proc/i8k creation error Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 10/45] mac80211: send ADDBA requests using the tid/queue of the aggregation session Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 11/45] recordmcount.pl: look for jgnop instruction as well as bcrl on s390 Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 12/45] dm btree remove: fix use after free in rebalance_children() Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 13/45] audit: improve robustness of the audit queue handling Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 14/45] nfsd: fix use-after-free due to delegation race Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 15/45] x86: Make ARCH_USE_MEMREMAP_PROT a generic Kconfig symbol Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 16/45] x86/sme: Explicitly map new EFI memmap table as encrypted Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 17/45] hv: utils: add PTP_1588_CLOCK to Kconfig to fix build Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 18/45] ARM: socfpga: dts: fix qspi node compatible Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 19/45] dmaengine: st_fdma: fix MODULE_ALIAS Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 20/45] soc/tegra: fuse: Fix bitwise vs. logical OR warning Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 21/45] igbvf: fix double free in `igbvf_probe` Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 22/45] ixgbe: set X550 MDIO speed before talking to PHY Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 23/45] net/packet: rx_owner_map depends on pg_vec Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 24/45] sit: do not call ipip6_dev_free() from sit_init_net() Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 25/45] USB: gadget: bRequestType is a bitfield, not a enum Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 26/45] PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 27/45] PCI/MSI: Mask MSI-X vectors only on success Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 28/45] USB: serial: option: add Telit FN990 compositions Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 29/45] timekeeping: Really make sure wall_to_monotonic isnt positive Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 30/45] libata: if T_LENGTH is zero, dma direction should be DMA_NONE Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 31/45] net: systemport: Add global locking for descriptor lifecycle Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 32/45] firmware: arm_scpi: Fix string overflow in SCPI genpd driver Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 33/45] ARM: dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 34/45] fuse: annotate lock in fuse_reverse_inval_entry() Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 35/45] scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 36/45] net: lan78xx: Avoid unnecessary self assignment Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 37/45] ARM: 8805/2: remove unneeded naked function usage Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 38/45] mwifiex: Remove unnecessary braces from HostCmd_SET_SEQ_NO_BSS_INFO Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 39/45] ARM: 8800/1: use choice for kernel unwinders Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 40/45] Input: touchscreen - avoid bitwise vs logical OR warning Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 41/45] xen/blkfront: harden blkfront against event channel storms Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 42/45] xen/netfront: harden netfront " Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 43/45] xen/console: harden hvc_xen " Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 44/45] xen/netback: fix rx queue stall detection Greg Kroah-Hartman
2021-12-20 14:34 ` [PATCH 4.14 45/45] xen/netback: dont queue unlimited number of packages Greg Kroah-Hartman
2021-12-21 17:22 ` [PATCH 4.14 00/45] 4.14.259-rc1 review Naresh Kamboju
2021-12-21 23:12 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211220143022.315776376@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=krzysztof.kozlowski@canonical.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+f9f76f4a0766420b4a02@syzkaller.appspotmail.com \
--cc=tadeusz.struk@linaro.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox