netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH net] ipv6: sr: fix invalid unregister error path
@ 2024-05-07  8:11 Hangbin Liu
  2024-05-07  9:14 ` Sabrina Dubroca
  0 siblings, 1 reply; 3+ messages in thread
From: Hangbin Liu @ 2024-05-07  8:11 UTC (permalink / raw)
  To: netdev
  Cc: David S. Miller, David Ahern, Eric Dumazet, Jakub Kicinski,
	Paolo Abeni, Vasiliy Kovalev, Hangbin Liu, Guillaume Nault

The error path of seg6_init() is wrong in case CONFIG_IPV6_SEG6_LWTUNNEL
is not defined. In that case if seg6_hmac_init() fails, the
genl_unregister_family() isn't called.

At the same time, add seg6_local_exit() and fix the genl unregister order
in seg6_exit().

Fixes: 5559cea2d5aa ("ipv6: sr: fix possible use-after-free and null-ptr-deref")
Reported-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
---
 net/ipv6/seg6.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index 35508abd76f4..3c5ccc52d0e1 100644
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -549,10 +549,8 @@ int __init seg6_init(void)
 	seg6_iptunnel_exit();
 #endif
 #endif
-#ifdef CONFIG_IPV6_SEG6_LWTUNNEL
 out_unregister_genl:
 	genl_unregister_family(&seg6_genl_family);
-#endif
 out_unregister_pernet:
 	unregister_pernet_subsys(&ip6_segments_ops);
 	goto out;
@@ -564,8 +562,9 @@ void seg6_exit(void)
 	seg6_hmac_exit();
 #endif
 #ifdef CONFIG_IPV6_SEG6_LWTUNNEL
+	seg6_local_exit();
 	seg6_iptunnel_exit();
 #endif
-	unregister_pernet_subsys(&ip6_segments_ops);
 	genl_unregister_family(&seg6_genl_family);
+	unregister_pernet_subsys(&ip6_segments_ops);
 }
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 3+ messages in thread

* Re: [PATCH net] ipv6: sr: fix invalid unregister error path
  2024-05-07  8:11 [PATCH net] ipv6: sr: fix invalid unregister error path Hangbin Liu
@ 2024-05-07  9:14 ` Sabrina Dubroca
  2024-05-07  9:39   ` Hangbin Liu
  0 siblings, 1 reply; 3+ messages in thread
From: Sabrina Dubroca @ 2024-05-07  9:14 UTC (permalink / raw)
  To: Hangbin Liu
  Cc: netdev, David S. Miller, David Ahern, Eric Dumazet,
	Jakub Kicinski, Paolo Abeni, Vasiliy Kovalev, Guillaume Nault

2024-05-07, 16:11:00 +0800, Hangbin Liu wrote:
> The error path of seg6_init() is wrong in case CONFIG_IPV6_SEG6_LWTUNNEL
> is not defined. In that case if seg6_hmac_init() fails, the
> genl_unregister_family() isn't called.
> 
> At the same time, add seg6_local_exit() and fix the genl unregister order
> in seg6_exit().
> 
> Fixes: 5559cea2d5aa ("ipv6: sr: fix possible use-after-free and null-ptr-deref")
> Reported-by: Guillaume Nault <gnault@redhat.com>
> Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
> ---
>  net/ipv6/seg6.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
> index 35508abd76f4..3c5ccc52d0e1 100644
> --- a/net/ipv6/seg6.c
> +++ b/net/ipv6/seg6.c
> @@ -549,10 +549,8 @@ int __init seg6_init(void)
>  	seg6_iptunnel_exit();
>  #endif
>  #endif
> -#ifdef CONFIG_IPV6_SEG6_LWTUNNEL
>  out_unregister_genl:
>  	genl_unregister_family(&seg6_genl_family);

That label will be defined but unused for !CONFIG_IPV6_SEG6_LWTUNNEL.

> -#endif
>  out_unregister_pernet:
>  	unregister_pernet_subsys(&ip6_segments_ops);
>  	goto out;
> @@ -564,8 +562,9 @@ void seg6_exit(void)
>  	seg6_hmac_exit();
>  #endif
>  #ifdef CONFIG_IPV6_SEG6_LWTUNNEL
> +	seg6_local_exit();
>  	seg6_iptunnel_exit();
>  #endif
> -	unregister_pernet_subsys(&ip6_segments_ops);
>  	genl_unregister_family(&seg6_genl_family);
> +	unregister_pernet_subsys(&ip6_segments_ops);
>  }
> -- 
> 2.43.0
> 
> 

-- 
Sabrina


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH net] ipv6: sr: fix invalid unregister error path
  2024-05-07  9:14 ` Sabrina Dubroca
@ 2024-05-07  9:39   ` Hangbin Liu
  0 siblings, 0 replies; 3+ messages in thread
From: Hangbin Liu @ 2024-05-07  9:39 UTC (permalink / raw)
  To: Sabrina Dubroca
  Cc: netdev, David S. Miller, David Ahern, Eric Dumazet,
	Jakub Kicinski, Paolo Abeni, Vasiliy Kovalev, Guillaume Nault

On Tue, May 07, 2024 at 11:14:45AM +0200, Sabrina Dubroca wrote:
> 2024-05-07, 16:11:00 +0800, Hangbin Liu wrote:
> > The error path of seg6_init() is wrong in case CONFIG_IPV6_SEG6_LWTUNNEL
> > is not defined. In that case if seg6_hmac_init() fails, the
> > genl_unregister_family() isn't called.
> > 
> > At the same time, add seg6_local_exit() and fix the genl unregister order
> > in seg6_exit().
> > 
> > Fixes: 5559cea2d5aa ("ipv6: sr: fix possible use-after-free and null-ptr-deref")
> > Reported-by: Guillaume Nault <gnault@redhat.com>
> > Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
> > ---
> >  net/ipv6/seg6.c | 5 ++---
> >  1 file changed, 2 insertions(+), 3 deletions(-)
> > 
> > diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
> > index 35508abd76f4..3c5ccc52d0e1 100644
> > --- a/net/ipv6/seg6.c
> > +++ b/net/ipv6/seg6.c
> > @@ -549,10 +549,8 @@ int __init seg6_init(void)
> >  	seg6_iptunnel_exit();
> >  #endif
> >  #endif
> > -#ifdef CONFIG_IPV6_SEG6_LWTUNNEL
> >  out_unregister_genl:
> >  	genl_unregister_family(&seg6_genl_family);
> 
> That label will be defined but unused for !CONFIG_IPV6_SEG6_LWTUNNEL.

Ah, yes, I will add the CONFIG_IPV6_SEG6_LWTUNNEL definition in v2.

diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index 3c5ccc52d0e1..6a80d93399ce 100644
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -549,7 +549,9 @@ int __init seg6_init(void)
        seg6_iptunnel_exit();
 #endif
 #endif
+#ifdef CONFIG_IPV6_SEG6_LWTUNNEL
 out_unregister_genl:
+#endif
        genl_unregister_family(&seg6_genl_family);
 out_unregister_pernet:
        unregister_pernet_subsys(&ip6_segments_ops);

Thanks
Hangbin

^ permalink raw reply related	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2024-05-07  9:39 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-05-07  8:11 [PATCH net] ipv6: sr: fix invalid unregister error path Hangbin Liu
2024-05-07  9:14 ` Sabrina Dubroca
2024-05-07  9:39   ` Hangbin Liu

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).