diff mbox series

[net-next] net: ethtool: use correct device pointer in ethnl_default_dump_one()

Message ID 20250307083544.1659135-1-edumazet@google.com (mailing list archive)
State Accepted
Commit f36a9285828c92ff9dffd4873b8365ca8406f071
Delegated to: Netdev Maintainers
Headers show
Series [net-next] net: ethtool: use correct device pointer in ethnl_default_dump_one() | expand

Checks

Context Check Description
netdev/series_format success Single patches do not need cover letters
netdev/tree_selection success Clearly marked for net-next, async
netdev/ynl success Generated files up to date; no warnings/errors; no diff in generated;
netdev/fixes_present success Fixes tag not required for -next series
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 0 this patch: 0
netdev/build_tools success No tools touched, skip
netdev/cc_maintainers warning 2 maintainers not CCed: maxime.chevallier@bootlin.com andrew@lunn.ch
netdev/build_clang success Errors and warnings before: 0 this patch: 0
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/deprecated_api success None detected
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success Fixes tag looks correct
netdev/build_allmodconfig_warn success Errors and warnings before: 0 this patch: 0
netdev/checkpatch success total: 0 errors, 0 warnings, 0 checks, 11 lines checked
netdev/build_clang_rust success No Rust files in patch. Skipping build
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0
netdev/contest success net-next-2025-03-07--12-00 (tests: 894)

Commit Message

Eric Dumazet March 7, 2025, 8:35 a.m. UTC 
ethnl_default_dump_one() operates on the device provided in its @dev
parameter, not from ctx->req_info->dev.

syzbot reported:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000197: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000cb8-0x0000000000000cbf]
 RIP: 0010:netdev_need_ops_lock include/linux/netdevice.h:2792 [inline]
 RIP: 0010:netdev_lock_ops include/linux/netdevice.h:2803 [inline]
 RIP: 0010:ethnl_default_dump_one net/ethtool/netlink.c:557 [inline]
 RIP: 0010:ethnl_default_dumpit+0x447/0xd40 net/ethtool/netlink.c:593
Call Trace:
 <TASK>
  genl_dumpit+0x10d/0x1b0 net/netlink/genetlink.c:1027
  netlink_dump+0x64d/0xe10 net/netlink/af_netlink.c:2309
  __netlink_dump_start+0x5a2/0x790 net/netlink/af_netlink.c:2424
  genl_family_rcv_msg_dumpit net/netlink/genetlink.c:1076 [inline]
  genl_family_rcv_msg net/netlink/genetlink.c:1192 [inline]
  genl_rcv_msg+0x894/0xec0 net/netlink/genetlink.c:1210
  netlink_rcv_skb+0x206/0x480 net/netlink/af_netlink.c:2534
  genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
  netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
  netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1339
  netlink_sendmsg+0x8de/0xcb0 net/netlink/af_netlink.c:1883
  sock_sendmsg_nosec net/socket.c:709 [inline]
  __sock_sendmsg+0x221/0x270 net/socket.c:724
  ____sys_sendmsg+0x53a/0x860 net/socket.c:2564
  ___sys_sendmsg net/socket.c:2618 [inline]
  __sys_sendmsg+0x269/0x350 net/socket.c:2650

Fixes: 2bcf4772e45a ("net: ethtool: try to protect all callback with netdev instance lock")
Reported-by: syzbot+3da2442641f0c6a705a2@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/lkml/67caaf5e.050a0220.15b4b9.007a.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/ethtool/netlink.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Stanislav Fomichev March 7, 2025, 3:23 p.m. UTC | #1 
On 03/07, Eric Dumazet wrote:
> ethnl_default_dump_one() operates on the device provided in its @dev
> parameter, not from ctx->req_info->dev.
> 
> syzbot reported:
> 
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000197: 0000 [#1] PREEMPT SMP KASAN PTI
> KASAN: null-ptr-deref in range [0x0000000000000cb8-0x0000000000000cbf]
>  RIP: 0010:netdev_need_ops_lock include/linux/netdevice.h:2792 [inline]
>  RIP: 0010:netdev_lock_ops include/linux/netdevice.h:2803 [inline]
>  RIP: 0010:ethnl_default_dump_one net/ethtool/netlink.c:557 [inline]
>  RIP: 0010:ethnl_default_dumpit+0x447/0xd40 net/ethtool/netlink.c:593
> Call Trace:
>  <TASK>
>   genl_dumpit+0x10d/0x1b0 net/netlink/genetlink.c:1027
>   netlink_dump+0x64d/0xe10 net/netlink/af_netlink.c:2309
>   __netlink_dump_start+0x5a2/0x790 net/netlink/af_netlink.c:2424
>   genl_family_rcv_msg_dumpit net/netlink/genetlink.c:1076 [inline]
>   genl_family_rcv_msg net/netlink/genetlink.c:1192 [inline]
>   genl_rcv_msg+0x894/0xec0 net/netlink/genetlink.c:1210
>   netlink_rcv_skb+0x206/0x480 net/netlink/af_netlink.c:2534
>   genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
>   netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
>   netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1339
>   netlink_sendmsg+0x8de/0xcb0 net/netlink/af_netlink.c:1883
>   sock_sendmsg_nosec net/socket.c:709 [inline]
>   __sock_sendmsg+0x221/0x270 net/socket.c:724
>   ____sys_sendmsg+0x53a/0x860 net/socket.c:2564
>   ___sys_sendmsg net/socket.c:2618 [inline]
>   __sys_sendmsg+0x269/0x350 net/socket.c:2650
> 
> Fixes: 2bcf4772e45a ("net: ethtool: try to protect all callback with netdev instance lock")
> Reported-by: syzbot+3da2442641f0c6a705a2@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/lkml/67caaf5e.050a0220.15b4b9.007a.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Acked-by: Stanislav Fomichev <sdf@fomichev.me>
patchwork-bot+netdevbpf@kernel.org March 8, 2025, 3:40 a.m. UTC | #2 
Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri,  7 Mar 2025 08:35:44 +0000 you wrote:
> ethnl_default_dump_one() operates on the device provided in its @dev
> parameter, not from ctx->req_info->dev.
> 
> syzbot reported:
> 
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000197: 0000 [#1] PREEMPT SMP KASAN PTI
> KASAN: null-ptr-deref in range [0x0000000000000cb8-0x0000000000000cbf]
>  RIP: 0010:netdev_need_ops_lock include/linux/netdevice.h:2792 [inline]
>  RIP: 0010:netdev_lock_ops include/linux/netdevice.h:2803 [inline]
>  RIP: 0010:ethnl_default_dump_one net/ethtool/netlink.c:557 [inline]
>  RIP: 0010:ethnl_default_dumpit+0x447/0xd40 net/ethtool/netlink.c:593
> Call Trace:
>  <TASK>
>   genl_dumpit+0x10d/0x1b0 net/netlink/genetlink.c:1027
>   netlink_dump+0x64d/0xe10 net/netlink/af_netlink.c:2309
>   __netlink_dump_start+0x5a2/0x790 net/netlink/af_netlink.c:2424
>   genl_family_rcv_msg_dumpit net/netlink/genetlink.c:1076 [inline]
>   genl_family_rcv_msg net/netlink/genetlink.c:1192 [inline]
>   genl_rcv_msg+0x894/0xec0 net/netlink/genetlink.c:1210
>   netlink_rcv_skb+0x206/0x480 net/netlink/af_netlink.c:2534
>   genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
>   netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
>   netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1339
>   netlink_sendmsg+0x8de/0xcb0 net/netlink/af_netlink.c:1883
>   sock_sendmsg_nosec net/socket.c:709 [inline]
>   __sock_sendmsg+0x221/0x270 net/socket.c:724
>   ____sys_sendmsg+0x53a/0x860 net/socket.c:2564
>   ___sys_sendmsg net/socket.c:2618 [inline]
>   __sys_sendmsg+0x269/0x350 net/socket.c:2650
> 
> [...]

Here is the summary with links:
  - [net-next] net: ethtool: use correct device pointer in ethnl_default_dump_one()
    https://git.kernel.org/netdev/net-next/c/f36a9285828c

You are awesome, thank you!
diff mbox series

Patch

diff --git a/net/ethtool/netlink.c b/net/ethtool/netlink.c
index 239b5252ed2a1925f03b876ca47c6613f76b4636..70834947f474cb724073e890d3d4f428e7d4e785 100644
--- a/net/ethtool/netlink.c
+++ b/net/ethtool/netlink.c
@@ -554,9 +554,9 @@  static int ethnl_default_dump_one(struct sk_buff *skb, struct net_device *dev,
 
 	ethnl_init_reply_data(ctx->reply_data, ctx->ops, dev);
 	rtnl_lock();
-	netdev_lock_ops(ctx->req_info->dev);
+	netdev_lock_ops(dev);
 	ret = ctx->ops->prepare_data(ctx->req_info, ctx->reply_data, info);
-	netdev_unlock_ops(ctx->req_info->dev);
+	netdev_unlock_ops(dev);
 	rtnl_unlock();
 	if (ret < 0)
 		goto out;