Thread (2 messages) flat view 2 messages, 2 authors, 2021-01-06

Re: [PATCH v2] net: qrtr: fix null-ptr-deref in qrtr_ns_remove

From: David Miller <davem@davemloft.net>
Date: 2021-01-06 00:51:24
Also in: lkml

From: Qinglang Miao <redacted>
Date: Tue, 5 Jan 2021 13:57:54 +0800
A null-ptr-deref bug is reported by Hulk Robot like this:
--------------
KASAN: null-ptr-deref in range [0x0000000000000128-0x000000000000012f]
Call Trace:
qrtr_ns_remove+0x22/0x40 [ns]
qrtr_proto_fini+0xa/0x31 [qrtr]
__x64_sys_delete_module+0x337/0x4e0
do_syscall_64+0x34/0x80
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x468ded
--------------

When qrtr_ns_init fails in qrtr_proto_init, qrtr_ns_remove which would
be called later on would raise a null-ptr-deref because qrtr_ns.workqueue
has been destroyed.

Fix it by making qrtr_ns_init have a return value and adding a check in
qrtr_proto_init.

Reported-by: Hulk Robot <redacted>
Signed-off-by: Qinglang Miao <redacted>
---
v1->v2: remove redundant braces for single statement blocks.
Applied.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help