[PATCH net] netdev: fix double-free in netdev_nl_bind_rx_doit()

[PATCH net] netdev: fix double-free in netdev_nl_bind_rx_doit()

[Jakub Kicinski]

Sashiko flags that genlmsg_reply() always consumes the skb.
The error path calls nlmsg_free(rsp) so we can't jump directly
to it. Let's not unbind, just propagate the error to the user.
This is the typical way of handling genlmsg_reply() failures.
They shouldn't happen unless user does something silly like
calling the kernel with an already-full rcvbuf.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: 170aafe35cb9 ("netdev: support binding dma-buf to netdevice")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
CC: bobbyeshleman@gmail.com
CC: dw@davidwei.uk
CC: daniel@iogearbox.net
CC: razor@blackwall.org
CC: sdf@fomichev.me
CC: willemb@google.com
CC: kaiyuanz@google.com
---
 net/core/netdev-genl.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/net/core/netdev-genl.c b/net/core/netdev-genl.c
index b4d48f3672a5..11b0b91683d7 100644
--- a/net/core/netdev-genl.c
+++ b/net/core/netdev-genl.c
@@ -1095,8 +1095,6 @@ int netdev_nl_bind_rx_doit(struct sk_buff *skb, struct genl_info *info)
 	genlmsg_end(rsp, hdr);
 
 	err = genlmsg_reply(rsp, info);
-	if (err)
-		goto err_unbind;
 
 	bitmap_free(rxq_bitmap);
 
@@ -1104,7 +1102,7 @@ int netdev_nl_bind_rx_doit(struct sk_buff *skb, struct genl_info *info)
 
 	mutex_unlock(&priv->lock);
 
-	return 0;
+	return err < 0 ? err : 0;
 
 err_unbind:
 	net_devmem_unbind_dmabuf(binding);
-- 
2.54.0

Re: [PATCH net] netdev: fix double-free in netdev_nl_bind_rx_doit()

[Bobby Eshleman]

On Fri, Jun 05, 2026 at 06:21:24PM -0700, Jakub Kicinski wrote:
> Sashiko flags that genlmsg_reply() always consumes the skb.
> The error path calls nlmsg_free(rsp) so we can't jump directly
> to it. Let's not unbind, just propagate the error to the user.
> This is the typical way of handling genlmsg_reply() failures.
> They shouldn't happen unless user does something silly like
> calling the kernel with an already-full rcvbuf.
> 
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Fixes: 170aafe35cb9 ("netdev: support binding dma-buf to netdevice")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---
> CC: bobbyeshleman@gmail.com
> CC: dw@davidwei.uk
> CC: daniel@iogearbox.net
> CC: razor@blackwall.org
> CC: sdf@fomichev.me
> CC: willemb@google.com
> CC: kaiyuanz@google.com
> ---
>  net/core/netdev-genl.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
> 
> diff --git a/net/core/netdev-genl.c b/net/core/netdev-genl.c
> index b4d48f3672a5..11b0b91683d7 100644
> --- a/net/core/netdev-genl.c
> +++ b/net/core/netdev-genl.c
> @@ -1095,8 +1095,6 @@ int netdev_nl_bind_rx_doit(struct sk_buff *skb, struct genl_info *info)
>  	genlmsg_end(rsp, hdr);
>  
>  	err = genlmsg_reply(rsp, info);
> -	if (err)
> -		goto err_unbind;
>  
>  	bitmap_free(rxq_bitmap);
>  
> @@ -1104,7 +1102,7 @@ int netdev_nl_bind_rx_doit(struct sk_buff *skb, struct genl_info *info)
>  
>  	mutex_unlock(&priv->lock);
>  
> -	return 0;
> +	return err < 0 ? err : 0;
>  
>  err_unbind:
>  	net_devmem_unbind_dmabuf(binding);
> -- 
> 2.54.0
> 

Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>

Re: [PATCH net] netdev: fix double-free in netdev_nl_bind_rx_doit()

[Daniel Borkmann]

On 6/6/26 3:21 AM, Jakub Kicinski wrote:
> Sashiko flags that genlmsg_reply() always consumes the skb.
> The error path calls nlmsg_free(rsp) so we can't jump directly
> to it. Let's not unbind, just propagate the error to the user.
> This is the typical way of handling genlmsg_reply() failures.
> They shouldn't happen unless user does something silly like
> calling the kernel with an already-full rcvbuf.
> 
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Fixes: 170aafe35cb9 ("netdev: support binding dma-buf to netdevice")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>

Re: [PATCH net] netdev: fix double-free in netdev_nl_bind_rx_doit()

[Nikolay Aleksandrov]

On 06/06/2026 04:21, Jakub Kicinski wrote:
> Sashiko flags that genlmsg_reply() always consumes the skb.
> The error path calls nlmsg_free(rsp) so we can't jump directly
> to it. Let's not unbind, just propagate the error to the user.
> This is the typical way of handling genlmsg_reply() failures.
> They shouldn't happen unless user does something silly like
> calling the kernel with an already-full rcvbuf.
> 
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Fixes: 170aafe35cb9 ("netdev: support binding dma-buf to netdevice")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---
> CC: bobbyeshleman@gmail.com
> CC: dw@davidwei.uk
> CC: daniel@iogearbox.net
> CC: razor@blackwall.org
> CC: sdf@fomichev.me
> CC: willemb@google.com
> CC: kaiyuanz@google.com
> ---
>   net/core/netdev-genl.c | 4 +---
>   1 file changed, 1 insertion(+), 3 deletions(-)
> 
> diff --git a/net/core/netdev-genl.c b/net/core/netdev-genl.c
> index b4d48f3672a5..11b0b91683d7 100644
> --- a/net/core/netdev-genl.c
> +++ b/net/core/netdev-genl.c
> @@ -1095,8 +1095,6 @@ int netdev_nl_bind_rx_doit(struct sk_buff *skb, struct genl_info *info)
>   	genlmsg_end(rsp, hdr);
>   
>   	err = genlmsg_reply(rsp, info);
> -	if (err)
> -		goto err_unbind;
>   
>   	bitmap_free(rxq_bitmap);
>   
> @@ -1104,7 +1102,7 @@ int netdev_nl_bind_rx_doit(struct sk_buff *skb, struct genl_info *info)
>   
>   	mutex_unlock(&priv->lock);
>   
> -	return 0;
> +	return err < 0 ? err : 0;
>   
>   err_unbind:
>   	net_devmem_unbind_dmabuf(binding);

Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>

Re: [PATCH net] netdev: fix double-free in netdev_nl_bind_rx_doit()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri,  5 Jun 2026 18:21:24 -0700 you wrote:
> Sashiko flags that genlmsg_reply() always consumes the skb.
> The error path calls nlmsg_free(rsp) so we can't jump directly
> to it. Let's not unbind, just propagate the error to the user.
> This is the typical way of handling genlmsg_reply() failures.
> They shouldn't happen unless user does something silly like
> calling the kernel with an already-full rcvbuf.
> 
> [...]

Here is the summary with links:
  - [net] netdev: fix double-free in netdev_nl_bind_rx_doit()
    https://git.kernel.org/netdev/net/c/c849de7d8757

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html