From: Leon Romanovsky <leon@kernel•org>
To: Chen Zhongjin <chenzhongjin@huawei•com>
Cc: linux-kernel@vger•kernel.org, netdev@vger•kernel.org,
steffen.klassert@secunet•com, herbert@gondor•apana.org.au,
davem@davemloft•net, yoshfuji@linux-ipv6•org, dsahern@kernel•org,
edumazet@google•com, kuba@kernel•org, pabeni@redhat•com,
mkubecek@suse•cz
Subject: Re: [PATCH net] xfrm: Fix ignored return value in xfrm6_init()
Date: Mon, 7 Nov 2022 10:06:48 +0200 [thread overview]
Message-ID: <Y2i8mC0fNrs4MJsq@unreal> (raw)
In-Reply-To: <917fab11-ae57-07b9-ae67-7c290c7c6723@huawei.com>
On Mon, Nov 07, 2022 at 11:22:40AM +0800, Chen Zhongjin wrote:
> Hi,
>
> On 2022/11/7 3:08, Leon Romanovsky wrote:
> > On Thu, Nov 03, 2022 at 05:07:13PM +0800, Chen Zhongjin wrote:
> > > When IPv6 module initializing in xfrm6_init(), register_pernet_subsys()
> > > is possible to fail but its return value is ignored.
> > >
> > > If IPv6 initialization fails later and xfrm6_fini() is called,
> > > removing uninitialized list in xfrm6_net_ops will cause null-ptr-deref:
> > >
> > > KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
> > > CPU: 1 PID: 330 Comm: insmod
> > > RIP: 0010:unregister_pernet_operations+0xc9/0x450
> > > Call Trace:
> > > <TASK>
> > > unregister_pernet_subsys+0x31/0x3e
> > > xfrm6_fini+0x16/0x30 [ipv6]
> > > ip6_route_init+0xcd/0x128 [ipv6]
> > > inet6_init+0x29c/0x602 [ipv6]
> > > ...
> > >
> > > Fix it by catching the error return value of register_pernet_subsys().
> > >
> > > Fixes: 8d068875caca ("xfrm: make gc_thresh configurable in all namespaces")
> > > Signed-off-by: Chen Zhongjin <chenzhongjin@huawei•com>
> > > ---
> > > net/ipv6/xfrm6_policy.c | 6 +++++-
> > > 1 file changed, 5 insertions(+), 1 deletion(-)
> > I see same error in net/ipv4/xfrm4_policy.c which introduced by same
> > commit mentioned in Fixes line.
>
> It's true that in xfrm4_init() the ops->init is possible to fail as well.
>
> However there is no error handling or exit path for ipv4, so IIUC the ops
> won't be unregistered anyway.
>
> Considering that ipv4 don't handle most of error in initialization, maybe
> it's better to keep it as it is?
Yeah, makes sense.
Thanks,
Reviewed-by: Leon Romanovsky <leonro@nvidia•com>
next prev parent reply other threads:[~2022-11-07 8:08 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-03 9:07 [PATCH net] xfrm: Fix ignored return value in xfrm6_init() Chen Zhongjin
2022-11-06 19:08 ` Leon Romanovsky
2022-11-07 3:22 ` Chen Zhongjin
2022-11-07 8:06 ` Leon Romanovsky [this message]
2022-11-17 6:33 ` Steffen Klassert
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y2i8mC0fNrs4MJsq@unreal \
--to=leon@kernel$(echo .)org \
--cc=chenzhongjin@huawei$(echo .)com \
--cc=davem@davemloft$(echo .)net \
--cc=dsahern@kernel$(echo .)org \
--cc=edumazet@google$(echo .)com \
--cc=herbert@gondor$(echo .)apana.org.au \
--cc=kuba@kernel$(echo .)org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=mkubecek@suse$(echo .)cz \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=steffen.klassert@secunet$(echo .)com \
--cc=yoshfuji@linux-ipv6$(echo .)org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox