[PATCH net] net: prevent a NULL deref in rtnl_create_link()

[PATCH net] net: prevent a NULL deref in rtnl_create_link()

[Eric Dumazet]

At the time rtnl_create_link() is running, dev->netdev_ops is NULL,
we must not use netdev_lock_ops() or risk a NULL deref if
CONFIG_NET_SHAPER is defined.

Use netif_set_group() instead of dev_set_group().

 RIP: 0010:netdev_need_ops_lock include/net/netdev_lock.h:33 [inline]
 RIP: 0010:netdev_lock_ops include/net/netdev_lock.h:41 [inline]
 RIP: 0010:dev_set_group+0xc0/0x230 net/core/dev_api.c:82
Call Trace:
 <TASK>
  rtnl_create_link+0x748/0xd10 net/core/rtnetlink.c:3674
  rtnl_newlink_create+0x25c/0xb00 net/core/rtnetlink.c:3813
  __rtnl_newlink net/core/rtnetlink.c:3940 [inline]
  rtnl_newlink+0x16d6/0x1c70 net/core/rtnetlink.c:4055
  rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6944
  netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2534
  netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
  netlink_unicast+0x75b/0x8d0 net/netlink/af_netlink.c:1339
  netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1883
  sock_sendmsg_nosec net/socket.c:712 [inline]

Reported-by: syzbot+9fc858ba0312b42b577e@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6840265f.a00a0220.d4325.0009.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Fixes: 7e4d784f5810 ("net: hold netdev instance lock during rtnetlink operations")
Cc: Stanislav Fomichev <sdf@fomichev.me>
---
 net/core/rtnetlink.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index f9a35bdc58ad2a6c7d2aa023bef9b48f72336bbc..c57692eb8da9d47c3b0943bf7b8d8b7f7d347836 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -3671,7 +3671,7 @@ struct net_device *rtnl_create_link(struct net *net, const char *ifname,
 	if (tb[IFLA_LINKMODE])
 		dev->link_mode = nla_get_u8(tb[IFLA_LINKMODE]);
 	if (tb[IFLA_GROUP])
-		dev_set_group(dev, nla_get_u32(tb[IFLA_GROUP]));
+		netif_set_group(dev, nla_get_u32(tb[IFLA_GROUP]));
 	if (tb[IFLA_GSO_MAX_SIZE])
 		netif_set_gso_max_size(dev, nla_get_u32(tb[IFLA_GSO_MAX_SIZE]));
 	if (tb[IFLA_GSO_MAX_SEGS])
-- 
2.50.0.rc0.604.gd4ff7b7c86-goog

Re: [PATCH net] net: prevent a NULL deref in rtnl_create_link()

[Stanislav Fomichev]

On 06/04, Eric Dumazet wrote:
> At the time rtnl_create_link() is running, dev->netdev_ops is NULL,
> we must not use netdev_lock_ops() or risk a NULL deref if
> CONFIG_NET_SHAPER is defined.
> 
> Use netif_set_group() instead of dev_set_group().
> 
>  RIP: 0010:netdev_need_ops_lock include/net/netdev_lock.h:33 [inline]
>  RIP: 0010:netdev_lock_ops include/net/netdev_lock.h:41 [inline]
>  RIP: 0010:dev_set_group+0xc0/0x230 net/core/dev_api.c:82
> Call Trace:
>  <TASK>
>   rtnl_create_link+0x748/0xd10 net/core/rtnetlink.c:3674
>   rtnl_newlink_create+0x25c/0xb00 net/core/rtnetlink.c:3813
>   __rtnl_newlink net/core/rtnetlink.c:3940 [inline]
>   rtnl_newlink+0x16d6/0x1c70 net/core/rtnetlink.c:4055
>   rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6944
>   netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2534
>   netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
>   netlink_unicast+0x75b/0x8d0 net/netlink/af_netlink.c:1339
>   netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1883
>   sock_sendmsg_nosec net/socket.c:712 [inline]
> 
> Reported-by: syzbot+9fc858ba0312b42b577e@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/6840265f.a00a0220.d4325.0009.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Fixes: 7e4d784f5810 ("net: hold netdev instance lock during rtnetlink operations")
> Cc: Stanislav Fomichev <sdf@fomichev.me>

Acked-by: Stanislav Fomichev <sdf@fomichev.me>

Re: [PATCH net] net: prevent a NULL deref in rtnl_create_link()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed,  4 Jun 2025 10:58:15 +0000 you wrote:
> At the time rtnl_create_link() is running, dev->netdev_ops is NULL,
> we must not use netdev_lock_ops() or risk a NULL deref if
> CONFIG_NET_SHAPER is defined.
> 
> Use netif_set_group() instead of dev_set_group().
> 
>  RIP: 0010:netdev_need_ops_lock include/net/netdev_lock.h:33 [inline]
>  RIP: 0010:netdev_lock_ops include/net/netdev_lock.h:41 [inline]
>  RIP: 0010:dev_set_group+0xc0/0x230 net/core/dev_api.c:82
> Call Trace:
>  <TASK>
>   rtnl_create_link+0x748/0xd10 net/core/rtnetlink.c:3674
>   rtnl_newlink_create+0x25c/0xb00 net/core/rtnetlink.c:3813
>   __rtnl_newlink net/core/rtnetlink.c:3940 [inline]
>   rtnl_newlink+0x16d6/0x1c70 net/core/rtnetlink.c:4055
>   rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6944
>   netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2534
>   netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
>   netlink_unicast+0x75b/0x8d0 net/netlink/af_netlink.c:1339
>   netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1883
>   sock_sendmsg_nosec net/socket.c:712 [inline]
> 
> [...]

Here is the summary with links:
  - [net] net: prevent a NULL deref in rtnl_create_link()
    https://git.kernel.org/netdev/net/c/feafc73f3e6a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html