[PATCH] net-sysfs: fix NULL pointer dereference

[PATCH] net-sysfs: fix NULL pointer dereference

[Qasim Ijaz]

Commit <79c61899b5ee> introduces a potential NULL pointer dereference 
in the sysfs_rtnl_lock() function when initialising kn:

	kn = sysfs_break_active_protection(kobj, attr);
	
The commit overlooks the fact that sysfs_break_active_protection can 
return NULL if kernfs_find_and_get() fails to find and get the kernfs_node 
with the given name. 

Later on the code calls sysfs_unbreak_active_protection(kn) 
unconditionally, which could lead to a NULL pointer dereference.

Resolve this bug by introducing a NULL check before using kn
in the sysfs_unbreak_active_protection() call.

Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
Fixes: 79c61899b5ee ("net-sysfs: remove rtnl_trylock from device attributes")
---
 net/core/net-sysfs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 8d9dc048a548..c5085588e536 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -117,7 +117,8 @@ static int sysfs_rtnl_lock(struct kobject *kobj, struct attribute *attr,
 	 * the rtnl lock.
 	 */
 unbreak:
-	sysfs_unbreak_active_protection(kn);
+	if (kn)
+		sysfs_unbreak_active_protection(kn);
 	dev_put(ndev);
 
 	return ret;
-- 
2.39.5

Re: [PATCH] net-sysfs: fix NULL pointer dereference

[Antoine Tenart]

Quoting Qasim Ijaz (2025-03-06 00:53:07)
> Commit <79c61899b5ee> introduces a potential NULL pointer dereference 
> in the sysfs_rtnl_lock() function when initialising kn:
> 
>         kn = sysfs_break_active_protection(kobj, attr);
>         
> The commit overlooks the fact that sysfs_break_active_protection can 
> return NULL if kernfs_find_and_get() fails to find and get the kernfs_node 
> with the given name. 

If it fails to get it, should we let sysfs_rtnl_lock continue is
execution?

> Later on the code calls sysfs_unbreak_active_protection(kn) 
> unconditionally, which could lead to a NULL pointer dereference.
> 
> Resolve this bug by introducing a NULL check before using kn
> in the sysfs_unbreak_active_protection() call.

Did you see this in practice? Can you describe what led to this?

Thanks!
Antoine

> Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
> Fixes: 79c61899b5ee ("net-sysfs: remove rtnl_trylock from device attributes")
> ---
>  net/core/net-sysfs.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
> index 8d9dc048a548..c5085588e536 100644
> --- a/net/core/net-sysfs.c
> +++ b/net/core/net-sysfs.c
> @@ -117,7 +117,8 @@ static int sysfs_rtnl_lock(struct kobject *kobj, struct attribute *attr,
>          * the rtnl lock.
>          */
>  unbreak:
> -       sysfs_unbreak_active_protection(kn);
> +       if (kn)
> +               sysfs_unbreak_active_protection(kn);
>         dev_put(ndev);
>  
>         return ret;
> -- 
> 2.39.5
> 
>

Re: [PATCH] net-sysfs: fix NULL pointer dereference

[Qasim Ijaz]

On Thu, Mar 06, 2025 at 09:12:44AM +0100, Antoine Tenart wrote:
> Quoting Qasim Ijaz (2025-03-06 00:53:07)
> > Commit <79c61899b5ee> introduces a potential NULL pointer dereference 
> > in the sysfs_rtnl_lock() function when initialising kn:
> > 
> >         kn = sysfs_break_active_protection(kobj, attr);
> >         
> > The commit overlooks the fact that sysfs_break_active_protection can 
> > return NULL if kernfs_find_and_get() fails to find and get the kernfs_node 
> > with the given name. 
> 
> If it fails to get it, should we let sysfs_rtnl_lock continue is
> execution?

Hi Antoine, I think I may have misunderstood the code. Yes I do think it
would probably be better to end the function if
sysfs_break_active_protection fails. 

> 
> > Later on the code calls sysfs_unbreak_active_protection(kn) 
> > unconditionally, which could lead to a NULL pointer dereference.
> > 
> > Resolve this bug by introducing a NULL check before using kn
> > in the sysfs_unbreak_active_protection() call.
> 
> Did you see this in practice? Can you describe what led to this?

I have not seen this in practise but I think in terms of defensive
programming it could be a good addition to add a check to see if it
fails. If a function can return NULL then we should check for that, also
if we look at sysfs_break_active_protection being used throughout the
kernel there is multiple NULL checks so I think adding one here would be
handy. 

If you agree would you like me to send another patch where I check for
failure and end execution right away?

Thanks,
Qasim
> 
> Thanks!
> Antoine
> 
> > Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
> > Fixes: 79c61899b5ee ("net-sysfs: remove rtnl_trylock from device attributes")
> > ---
> >  net/core/net-sysfs.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> > 
> > diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
> > index 8d9dc048a548..c5085588e536 100644
> > --- a/net/core/net-sysfs.c
> > +++ b/net/core/net-sysfs.c
> > @@ -117,7 +117,8 @@ static int sysfs_rtnl_lock(struct kobject *kobj, struct attribute *attr,
> >          * the rtnl lock.
> >          */
> >  unbreak:
> > -       sysfs_unbreak_active_protection(kn);
> > +       if (kn)
> > +               sysfs_unbreak_active_protection(kn);
> >         dev_put(ndev);
> >  
> >         return ret;
> > -- 
> > 2.39.5
> > 
> >
> 

Re: [PATCH] net-sysfs: fix NULL pointer dereference

[Antoine Tenart]

Quoting Qasim Ijaz (2025-03-08 13:43:39)
> On Thu, Mar 06, 2025 at 09:12:44AM +0100, Antoine Tenart wrote:
> > Quoting Qasim Ijaz (2025-03-06 00:53:07)
> > 
> > > Later on the code calls sysfs_unbreak_active_protection(kn) 
> > > unconditionally, which could lead to a NULL pointer dereference.
> > > 
> > > Resolve this bug by introducing a NULL check before using kn
> > > in the sysfs_unbreak_active_protection() call.
> > 
> > Did you see this in practice? Can you describe what led to this?
> 
> I have not seen this in practise but I think in terms of defensive
> programming it could be a good addition to add a check to see if it
> fails. If a function can return NULL then we should check for that, also
> if we look at sysfs_break_active_protection being used throughout the
> kernel there is multiple NULL checks so I think adding one here would be
> handy. 

Not everywhere, there are at least two other examples. The only reason
sysfs_break_active_protection would return NULL is if the attribute
cannot be found in the kobject's sysfs directory; we got there because
of that exact attribute in that exact sysfs directory and refcounting
prevents them from disappearing.

We usually do not add a check if there is 0 chance to catch something.

Thanks,
Antoine