Subject: Re: [PATCH net ver.2] genetlink: fix possible use-after-free and null-ptr-deref in genl_dumpit()

From: [email-masked]
Date: Tue, 20 Feb 2024 14:03:55 +0300

Hi Pablo,

20.02.2024 13:36, Pablo Neira Ayuso wrote:
> On Tue, Feb 20, 2024 at 01:25:12PM +0300, [email-masked] wrote:
>> From: Vasiliy Kovalev <[email-masked]>
>>
>> The pernet operations structure for the subsystem must be registered
>> before registering the generic netlink family.
> IIRC, you pointed to a syzbot report on genetlink similar to gtp.

Yes, I was referring to the link 
https://lore.kernel.org/all/[email-masked]/T/ ,

>
> Maybe add that tag here and get the robot to test this fix?
but since the syzbot does not have a reproducer, I cannot say for sure 
that this is exactly the problem that this patch fixes, since syzbot 
refers to the tipc_udp_nl_dump_remoteip function and suddenly there is 
another problem...
>
> I'd suggest to describe the scenario, which is: There is a race that
> allows netlink dump and walking on pernet data while such pernet data
> is not yet set up.
>
> Thanks.

-- 
Regards,
Vasiliy Kovalev