[PATCH][net-next][v2] net: ethtool: Use hwprov under rcu_read_lock

[PATCH][net-next][v2] net: ethtool: Use hwprov under rcu_read_lock

[lirongqing]

From: Li RongQing <lirongqing@baidu.com>

hwprov should be protected by rcu_read_lock to prevent possible UAF

Fixes: 4c61d809cf60 ("net: ethtool: Fix suspicious rcu_dereference usage")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
diff with v1: move and use err varialbe, instead of define a new variable 

 net/ethtool/common.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/ethtool/common.c b/net/ethtool/common.c
index 2607aea..2bd77c9 100644
--- a/net/ethtool/common.c
+++ b/net/ethtool/common.c
@@ -869,6 +869,7 @@ int __ethtool_get_ts_info(struct net_device *dev,
 			  struct kernel_ethtool_ts_info *info)
 {
 	struct hwtstamp_provider *hwprov;
+	int err = 0;
 
 	rcu_read_lock();
 	hwprov = rcu_dereference(dev->hwprov);
@@ -876,7 +877,6 @@ int __ethtool_get_ts_info(struct net_device *dev,
 	if (!hwprov) {
 		const struct ethtool_ops *ops = dev->ethtool_ops;
 		struct phy_device *phydev = dev->phydev;
-		int err = 0;
 
 		ethtool_init_tsinfo(info);
 		if (phy_is_default_hwtstamp(phydev) &&
@@ -892,8 +892,9 @@ int __ethtool_get_ts_info(struct net_device *dev,
 		return err;
 	}
 
+	err = ethtool_get_ts_info_by_phc(dev, info, &hwprov->desc);
 	rcu_read_unlock();
-	return ethtool_get_ts_info_by_phc(dev, info, &hwprov->desc);
+	return err;
 }
 
 bool net_support_hwtstamp_qualifier(struct net_device *dev,
-- 
2.9.4

Re: [PATCH][net-next][v2] net: ethtool: Use hwprov under rcu_read_lock

[Kory Maincent]

On Thu, 9 Jan 2025 19:10:57 +0800
lirongqing <lirongqing@baidu.com> wrote:

> From: Li RongQing <lirongqing@baidu.com>
> 
> hwprov should be protected by rcu_read_lock to prevent possible UAF

Thanks for spotting it!

Acked-by: Kory Maincent <kory.maincent@bootlin.com>

-- 
Köry Maincent, Bootlin
Embedded Linux and kernel engineering
https://bootlin.com