| Message ID | 20221130091705.1831140-1-weiyongjun@huaweicloud.com (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [wpan] mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() | expand |
Hi, On Wed, Nov 30, 2022 at 4:19 AM Wei Yongjun <weiyongjun@huaweicloud.com> wrote: > > From: Wei Yongjun <weiyongjun1@huawei.com> > > Kernel fault injection test reports null-ptr-deref as follows: > > BUG: kernel NULL pointer dereference, address: 0000000000000008 > RIP: 0010:cfg802154_netdev_notifier_call+0x120/0x310 include/linux/list.h:114 > Call Trace: > <TASK> > raw_notifier_call_chain+0x6d/0xa0 kernel/notifier.c:87 > call_netdevice_notifiers_info+0x6e/0xc0 net/core/dev.c:1944 > unregister_netdevice_many_notify+0x60d/0xcb0 net/core/dev.c:1982 > unregister_netdevice_queue+0x154/0x1a0 net/core/dev.c:10879 > register_netdevice+0x9a8/0xb90 net/core/dev.c:10083 > ieee802154_if_add+0x6ed/0x7e0 net/mac802154/iface.c:659 > ieee802154_register_hw+0x29c/0x330 net/mac802154/main.c:229 > mcr20a_probe+0xaaa/0xcb1 drivers/net/ieee802154/mcr20a.c:1316 > > ieee802154_if_add() allocates wpan_dev as netdev's private data, but not > init the list in struct wpan_dev. cfg802154_netdev_notifier_call() manage > the list when device register/unregister, and may lead to null-ptr-deref. > > Use INIT_LIST_HEAD() on it to initialize it correctly. > > Fixes: fcf39e6e88e9 ("ieee802154: add wpan_dev_list") > Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Nice catch. :) Acked-by: Alexander Aring <aahringo@redhat.com> - Alex
Hello. On 04.12.22 23:49, Alexander Aring wrote: > Hi, > > On Wed, Nov 30, 2022 at 4:19 AM Wei Yongjun <weiyongjun@huaweicloud.com> wrote: >> >> From: Wei Yongjun <weiyongjun1@huawei.com> >> >> Kernel fault injection test reports null-ptr-deref as follows: >> >> BUG: kernel NULL pointer dereference, address: 0000000000000008 >> RIP: 0010:cfg802154_netdev_notifier_call+0x120/0x310 include/linux/list.h:114 >> Call Trace: >> <TASK> >> raw_notifier_call_chain+0x6d/0xa0 kernel/notifier.c:87 >> call_netdevice_notifiers_info+0x6e/0xc0 net/core/dev.c:1944 >> unregister_netdevice_many_notify+0x60d/0xcb0 net/core/dev.c:1982 >> unregister_netdevice_queue+0x154/0x1a0 net/core/dev.c:10879 >> register_netdevice+0x9a8/0xb90 net/core/dev.c:10083 >> ieee802154_if_add+0x6ed/0x7e0 net/mac802154/iface.c:659 >> ieee802154_register_hw+0x29c/0x330 net/mac802154/main.c:229 >> mcr20a_probe+0xaaa/0xcb1 drivers/net/ieee802154/mcr20a.c:1316 >> >> ieee802154_if_add() allocates wpan_dev as netdev's private data, but not >> init the list in struct wpan_dev. cfg802154_netdev_notifier_call() manage >> the list when device register/unregister, and may lead to null-ptr-deref. >> >> Use INIT_LIST_HEAD() on it to initialize it correctly. >> >> Fixes: fcf39e6e88e9 ("ieee802154: add wpan_dev_list") >> Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> > > Nice catch. :) > > Acked-by: Alexander Aring <aahringo@redhat.com> This patch has been applied to the wpan tree and will be part of the next pull request to net. Thanks! regards Stefan Schmidt
diff --git a/net/mac802154/iface.c b/net/mac802154/iface.c index d9b50884d34e..f6122ab15449 100644 --- a/net/mac802154/iface.c +++ b/net/mac802154/iface.c @@ -650,6 +650,7 @@ ieee802154_if_add(struct ieee802154_local *local, const char *name, sdata->dev = ndev; sdata->wpan_dev.wpan_phy = local->hw.phy; sdata->local = local; + INIT_LIST_HEAD(&sdata->wpan_dev.list); /* setup type-dependent data */ ret = ieee802154_setup_sdata(sdata, type);