* [PATCH net] ipv6: sr: fix invalid unregister error path
@ 2024-05-07 8:11 Hangbin Liu
2024-05-07 9:14 ` Sabrina Dubroca
0 siblings, 1 reply; 3+ messages in thread
From: Hangbin Liu @ 2024-05-07 8:11 UTC (permalink / raw)
To: netdev
Cc: David S. Miller, David Ahern, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Vasiliy Kovalev, Hangbin Liu, Guillaume Nault
The error path of seg6_init() is wrong in case CONFIG_IPV6_SEG6_LWTUNNEL
is not defined. In that case if seg6_hmac_init() fails, the
genl_unregister_family() isn't called.
At the same time, add seg6_local_exit() and fix the genl unregister order
in seg6_exit().
Fixes: 5559cea2d5aa ("ipv6: sr: fix possible use-after-free and null-ptr-deref")
Reported-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
---
net/ipv6/seg6.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index 35508abd76f4..3c5ccc52d0e1 100644
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -549,10 +549,8 @@ int __init seg6_init(void)
seg6_iptunnel_exit();
#endif
#endif
-#ifdef CONFIG_IPV6_SEG6_LWTUNNEL
out_unregister_genl:
genl_unregister_family(&seg6_genl_family);
-#endif
out_unregister_pernet:
unregister_pernet_subsys(&ip6_segments_ops);
goto out;
@@ -564,8 +562,9 @@ void seg6_exit(void)
seg6_hmac_exit();
#endif
#ifdef CONFIG_IPV6_SEG6_LWTUNNEL
+ seg6_local_exit();
seg6_iptunnel_exit();
#endif
- unregister_pernet_subsys(&ip6_segments_ops);
genl_unregister_family(&seg6_genl_family);
+ unregister_pernet_subsys(&ip6_segments_ops);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH net] ipv6: sr: fix invalid unregister error path
2024-05-07 8:11 [PATCH net] ipv6: sr: fix invalid unregister error path Hangbin Liu
@ 2024-05-07 9:14 ` Sabrina Dubroca
2024-05-07 9:39 ` Hangbin Liu
0 siblings, 1 reply; 3+ messages in thread
From: Sabrina Dubroca @ 2024-05-07 9:14 UTC (permalink / raw)
To: Hangbin Liu
Cc: netdev, David S. Miller, David Ahern, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Vasiliy Kovalev, Guillaume Nault
2024-05-07, 16:11:00 +0800, Hangbin Liu wrote:
> The error path of seg6_init() is wrong in case CONFIG_IPV6_SEG6_LWTUNNEL
> is not defined. In that case if seg6_hmac_init() fails, the
> genl_unregister_family() isn't called.
>
> At the same time, add seg6_local_exit() and fix the genl unregister order
> in seg6_exit().
>
> Fixes: 5559cea2d5aa ("ipv6: sr: fix possible use-after-free and null-ptr-deref")
> Reported-by: Guillaume Nault <gnault@redhat.com>
> Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
> ---
> net/ipv6/seg6.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
> index 35508abd76f4..3c5ccc52d0e1 100644
> --- a/net/ipv6/seg6.c
> +++ b/net/ipv6/seg6.c
> @@ -549,10 +549,8 @@ int __init seg6_init(void)
> seg6_iptunnel_exit();
> #endif
> #endif
> -#ifdef CONFIG_IPV6_SEG6_LWTUNNEL
> out_unregister_genl:
> genl_unregister_family(&seg6_genl_family);
That label will be defined but unused for !CONFIG_IPV6_SEG6_LWTUNNEL.
> -#endif
> out_unregister_pernet:
> unregister_pernet_subsys(&ip6_segments_ops);
> goto out;
> @@ -564,8 +562,9 @@ void seg6_exit(void)
> seg6_hmac_exit();
> #endif
> #ifdef CONFIG_IPV6_SEG6_LWTUNNEL
> + seg6_local_exit();
> seg6_iptunnel_exit();
> #endif
> - unregister_pernet_subsys(&ip6_segments_ops);
> genl_unregister_family(&seg6_genl_family);
> + unregister_pernet_subsys(&ip6_segments_ops);
> }
> --
> 2.43.0
>
>
--
Sabrina
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH net] ipv6: sr: fix invalid unregister error path
2024-05-07 9:14 ` Sabrina Dubroca
@ 2024-05-07 9:39 ` Hangbin Liu
0 siblings, 0 replies; 3+ messages in thread
From: Hangbin Liu @ 2024-05-07 9:39 UTC (permalink / raw)
To: Sabrina Dubroca
Cc: netdev, David S. Miller, David Ahern, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Vasiliy Kovalev, Guillaume Nault
On Tue, May 07, 2024 at 11:14:45AM +0200, Sabrina Dubroca wrote:
> 2024-05-07, 16:11:00 +0800, Hangbin Liu wrote:
> > The error path of seg6_init() is wrong in case CONFIG_IPV6_SEG6_LWTUNNEL
> > is not defined. In that case if seg6_hmac_init() fails, the
> > genl_unregister_family() isn't called.
> >
> > At the same time, add seg6_local_exit() and fix the genl unregister order
> > in seg6_exit().
> >
> > Fixes: 5559cea2d5aa ("ipv6: sr: fix possible use-after-free and null-ptr-deref")
> > Reported-by: Guillaume Nault <gnault@redhat.com>
> > Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
> > ---
> > net/ipv6/seg6.c | 5 ++---
> > 1 file changed, 2 insertions(+), 3 deletions(-)
> >
> > diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
> > index 35508abd76f4..3c5ccc52d0e1 100644
> > --- a/net/ipv6/seg6.c
> > +++ b/net/ipv6/seg6.c
> > @@ -549,10 +549,8 @@ int __init seg6_init(void)
> > seg6_iptunnel_exit();
> > #endif
> > #endif
> > -#ifdef CONFIG_IPV6_SEG6_LWTUNNEL
> > out_unregister_genl:
> > genl_unregister_family(&seg6_genl_family);
>
> That label will be defined but unused for !CONFIG_IPV6_SEG6_LWTUNNEL.
Ah, yes, I will add the CONFIG_IPV6_SEG6_LWTUNNEL definition in v2.
diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index 3c5ccc52d0e1..6a80d93399ce 100644
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -549,7 +549,9 @@ int __init seg6_init(void)
seg6_iptunnel_exit();
#endif
#endif
+#ifdef CONFIG_IPV6_SEG6_LWTUNNEL
out_unregister_genl:
+#endif
genl_unregister_family(&seg6_genl_family);
out_unregister_pernet:
unregister_pernet_subsys(&ip6_segments_ops);
Thanks
Hangbin
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-05-07 9:39 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-05-07 8:11 [PATCH net] ipv6: sr: fix invalid unregister error path Hangbin Liu
2024-05-07 9:14 ` Sabrina Dubroca
2024-05-07 9:39 ` Hangbin Liu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox