* [PATCH net-next] net: ethtool: use correct device pointer in ethnl_default_dump_one()
@ 2025-03-07 8:35 Eric Dumazet
2025-03-07 15:23 ` Stanislav Fomichev
2025-03-08 3:40 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 3+ messages in thread
From: Eric Dumazet @ 2025-03-07 8:35 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski, Paolo Abeni, Stanislav Fomichev
Cc: Simon Horman, netdev, eric.dumazet, Eric Dumazet,
syzbot+3da2442641f0c6a705a2
ethnl_default_dump_one() operates on the device provided in its @dev
parameter, not from ctx->req_info->dev.
syzbot reported:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000197: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000cb8-0x0000000000000cbf]
RIP: 0010:netdev_need_ops_lock include/linux/netdevice.h:2792 [inline]
RIP: 0010:netdev_lock_ops include/linux/netdevice.h:2803 [inline]
RIP: 0010:ethnl_default_dump_one net/ethtool/netlink.c:557 [inline]
RIP: 0010:ethnl_default_dumpit+0x447/0xd40 net/ethtool/netlink.c:593
Call Trace:
<TASK>
genl_dumpit+0x10d/0x1b0 net/netlink/genetlink.c:1027
netlink_dump+0x64d/0xe10 net/netlink/af_netlink.c:2309
__netlink_dump_start+0x5a2/0x790 net/netlink/af_netlink.c:2424
genl_family_rcv_msg_dumpit net/netlink/genetlink.c:1076 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:1192 [inline]
genl_rcv_msg+0x894/0xec0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x206/0x480 net/netlink/af_netlink.c:2534
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1339
netlink_sendmsg+0x8de/0xcb0 net/netlink/af_netlink.c:1883
sock_sendmsg_nosec net/socket.c:709 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:724
____sys_sendmsg+0x53a/0x860 net/socket.c:2564
___sys_sendmsg net/socket.c:2618 [inline]
__sys_sendmsg+0x269/0x350 net/socket.c:2650
Fixes: 2bcf4772e45a ("net: ethtool: try to protect all callback with netdev instance lock")
Reported-by: syzbot+3da2442641f0c6a705a2@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/lkml/67caaf5e.050a0220.15b4b9.007a.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
net/ethtool/netlink.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ethtool/netlink.c b/net/ethtool/netlink.c
index 239b5252ed2a1925f03b876ca47c6613f76b4636..70834947f474cb724073e890d3d4f428e7d4e785 100644
--- a/net/ethtool/netlink.c
+++ b/net/ethtool/netlink.c
@@ -554,9 +554,9 @@ static int ethnl_default_dump_one(struct sk_buff *skb, struct net_device *dev,
ethnl_init_reply_data(ctx->reply_data, ctx->ops, dev);
rtnl_lock();
- netdev_lock_ops(ctx->req_info->dev);
+ netdev_lock_ops(dev);
ret = ctx->ops->prepare_data(ctx->req_info, ctx->reply_data, info);
- netdev_unlock_ops(ctx->req_info->dev);
+ netdev_unlock_ops(dev);
rtnl_unlock();
if (ret < 0)
goto out;
--
2.49.0.rc0.332.g42c0ae87b1-goog
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net-next] net: ethtool: use correct device pointer in ethnl_default_dump_one()
2025-03-07 8:35 [PATCH net-next] net: ethtool: use correct device pointer in ethnl_default_dump_one() Eric Dumazet
@ 2025-03-07 15:23 ` Stanislav Fomichev
2025-03-08 3:40 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: Stanislav Fomichev @ 2025-03-07 15:23 UTC (permalink / raw)
To: Eric Dumazet
Cc: David S . Miller, Jakub Kicinski, Paolo Abeni, Stanislav Fomichev,
Simon Horman, netdev, eric.dumazet, syzbot+3da2442641f0c6a705a2
On 03/07, Eric Dumazet wrote:
> ethnl_default_dump_one() operates on the device provided in its @dev
> parameter, not from ctx->req_info->dev.
>
> syzbot reported:
>
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000197: 0000 [#1] PREEMPT SMP KASAN PTI
> KASAN: null-ptr-deref in range [0x0000000000000cb8-0x0000000000000cbf]
> RIP: 0010:netdev_need_ops_lock include/linux/netdevice.h:2792 [inline]
> RIP: 0010:netdev_lock_ops include/linux/netdevice.h:2803 [inline]
> RIP: 0010:ethnl_default_dump_one net/ethtool/netlink.c:557 [inline]
> RIP: 0010:ethnl_default_dumpit+0x447/0xd40 net/ethtool/netlink.c:593
> Call Trace:
> <TASK>
> genl_dumpit+0x10d/0x1b0 net/netlink/genetlink.c:1027
> netlink_dump+0x64d/0xe10 net/netlink/af_netlink.c:2309
> __netlink_dump_start+0x5a2/0x790 net/netlink/af_netlink.c:2424
> genl_family_rcv_msg_dumpit net/netlink/genetlink.c:1076 [inline]
> genl_family_rcv_msg net/netlink/genetlink.c:1192 [inline]
> genl_rcv_msg+0x894/0xec0 net/netlink/genetlink.c:1210
> netlink_rcv_skb+0x206/0x480 net/netlink/af_netlink.c:2534
> genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
> netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
> netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1339
> netlink_sendmsg+0x8de/0xcb0 net/netlink/af_netlink.c:1883
> sock_sendmsg_nosec net/socket.c:709 [inline]
> __sock_sendmsg+0x221/0x270 net/socket.c:724
> ____sys_sendmsg+0x53a/0x860 net/socket.c:2564
> ___sys_sendmsg net/socket.c:2618 [inline]
> __sys_sendmsg+0x269/0x350 net/socket.c:2650
>
> Fixes: 2bcf4772e45a ("net: ethtool: try to protect all callback with netdev instance lock")
> Reported-by: syzbot+3da2442641f0c6a705a2@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/lkml/67caaf5e.050a0220.15b4b9.007a.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net-next] net: ethtool: use correct device pointer in ethnl_default_dump_one()
2025-03-07 8:35 [PATCH net-next] net: ethtool: use correct device pointer in ethnl_default_dump_one() Eric Dumazet
2025-03-07 15:23 ` Stanislav Fomichev
@ 2025-03-08 3:40 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2025-03-08 3:40 UTC (permalink / raw)
To: Eric Dumazet
Cc: davem, kuba, pabeni, sdf, horms, netdev, eric.dumazet,
syzbot+3da2442641f0c6a705a2
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Fri, 7 Mar 2025 08:35:44 +0000 you wrote:
> ethnl_default_dump_one() operates on the device provided in its @dev
> parameter, not from ctx->req_info->dev.
>
> syzbot reported:
>
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000197: 0000 [#1] PREEMPT SMP KASAN PTI
> KASAN: null-ptr-deref in range [0x0000000000000cb8-0x0000000000000cbf]
> RIP: 0010:netdev_need_ops_lock include/linux/netdevice.h:2792 [inline]
> RIP: 0010:netdev_lock_ops include/linux/netdevice.h:2803 [inline]
> RIP: 0010:ethnl_default_dump_one net/ethtool/netlink.c:557 [inline]
> RIP: 0010:ethnl_default_dumpit+0x447/0xd40 net/ethtool/netlink.c:593
> Call Trace:
> <TASK>
> genl_dumpit+0x10d/0x1b0 net/netlink/genetlink.c:1027
> netlink_dump+0x64d/0xe10 net/netlink/af_netlink.c:2309
> __netlink_dump_start+0x5a2/0x790 net/netlink/af_netlink.c:2424
> genl_family_rcv_msg_dumpit net/netlink/genetlink.c:1076 [inline]
> genl_family_rcv_msg net/netlink/genetlink.c:1192 [inline]
> genl_rcv_msg+0x894/0xec0 net/netlink/genetlink.c:1210
> netlink_rcv_skb+0x206/0x480 net/netlink/af_netlink.c:2534
> genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
> netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
> netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1339
> netlink_sendmsg+0x8de/0xcb0 net/netlink/af_netlink.c:1883
> sock_sendmsg_nosec net/socket.c:709 [inline]
> __sock_sendmsg+0x221/0x270 net/socket.c:724
> ____sys_sendmsg+0x53a/0x860 net/socket.c:2564
> ___sys_sendmsg net/socket.c:2618 [inline]
> __sys_sendmsg+0x269/0x350 net/socket.c:2650
>
> [...]
Here is the summary with links:
- [net-next] net: ethtool: use correct device pointer in ethnl_default_dump_one()
https://git.kernel.org/netdev/net-next/c/f36a9285828c
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-03-08 3:40 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-03-07 8:35 [PATCH net-next] net: ethtool: use correct device pointer in ethnl_default_dump_one() Eric Dumazet
2025-03-07 15:23 ` Stanislav Fomichev
2025-03-08 3:40 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).