[PATCH net] net: hsr: fix NULL deref in hsr_get_node_data

[Xiang Mei <xmei5@asu.edu>]

hsr_get_node_data() looks up a node's address-B port and dereferences
port->dev->ifindex without checking the return value of
hsr_port_get_hsr(), which returns NULL when no port of the requested
type is currently attached.

node->addr_B_port is set by hsr_handle_sup_frame() on every supervision
frame but is never cleared when the corresponding slave is removed.
If one slave of an HSR master is unregistered while the master stays
alive (the other slave keeps it up), node_db entries retain a stale
addr_B_port. An unprivileged HSR_C_GET_NODE_STATUS query (genl op has
.flags = 0) then crashes the kernel:

  Oops: general protection fault, probably for non-canonical address
  0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
  RIP: 0010:hsr_get_node_data (net/hsr/hsr_framereg.c:892)
  Call Trace:
   hsr_get_node_status (net/hsr/hsr_netlink.c:366)
   genl_family_rcv_msg_doit (net/netlink/genetlink.c:1114)
   genl_rcv_msg (net/netlink/genetlink.c:1209)
   netlink_rcv_skb (net/netlink/af_netlink.c:2550)
   netlink_unicast (net/netlink/af_netlink.c:1344)
   netlink_sendmsg (net/netlink/af_netlink.c:1894)
   __sys_sendto (net/socket.c:2265)

Default *addr_b_ifindex to -1 and only overwrite it when the port
lookup succeeds. The caller hsr_get_node_status() already treats
addr_b_ifindex == -1 as "no address-B port" when emitting the
HSR_A_NODE_ADDR_B / HSR_A_ADDR_B_IFINDEX attributes, so behavior is
unchanged for valid setups.

Fixes: c5a759117210 ("net/hsr: Use list_head (and rcu) instead of array for slave devices.")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Xiang Mei <xmei5@asu.edu>
---
 net/hsr/hsr_framereg.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
index d09875b33588..8018d5c0c878 100644
--- a/net/hsr/hsr_framereg.c
+++ b/net/hsr/hsr_framereg.c
@@ -887,11 +887,11 @@ int hsr_get_node_data(struct hsr_priv *hsr,
 	if (hsr->prot_version != PRP_V1)
 		fill_last_seq_nrs(node, if1_seq, if2_seq);
 
+	*addr_b_ifindex = -1;
 	if (node->addr_B_port != HSR_PT_NONE) {
 		port = hsr_port_get_hsr(hsr, node->addr_B_port);
-		*addr_b_ifindex = port->dev->ifindex;
-	} else {
-		*addr_b_ifindex = -1;
+		if (port)
+			*addr_b_ifindex = port->dev->ifindex;
 	}
 
 	return 0;
-- 
2.43.0