Commit 4beb17e5 authored by Qinglang Miao's avatar Qinglang Miao Committed by David S. Miller
Browse files

net: qrtr: fix null-ptr-deref in qrtr_ns_remove 



A null-ptr-deref bug is reported by Hulk Robot like this:
--------------
KASAN: null-ptr-deref in range [0x0000000000000128-0x000000000000012f]
Call Trace:
qrtr_ns_remove+0x22/0x40 [ns]
qrtr_proto_fini+0xa/0x31 [qrtr]
__x64_sys_delete_module+0x337/0x4e0
do_syscall_64+0x34/0x80
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x468ded
--------------

When qrtr_ns_init fails in qrtr_proto_init, qrtr_ns_remove which would
be called later on would raise a null-ptr-deref because qrtr_ns.workqueue
has been destroyed.

Fix it by making qrtr_ns_init have a return value and adding a check in
qrtr_proto_init.

Reported-by: default avatarHulk Robot <hulkci@huawei.com>
Signed-off-by: default avatarQinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7a68d725

net/qrtr/ns.c

+4 −3
Original line number Diff line number Diff line
@@ -755,7 +755,7 @@ static void qrtr_ns_data_ready(struct sock *sk) 
	queue_work(qrtr_ns.workqueue, &qrtr_ns.work);

}



void qrtr_ns_init(void)

int qrtr_ns_init(void)

{

	struct sockaddr_qrtr sq;

	int ret;
@@ -766,7 +766,7 @@ void qrtr_ns_init(void) 
	ret = sock_create_kern(&init_net, AF_QIPCRTR, SOCK_DGRAM,

			       PF_QIPCRTR, &qrtr_ns.sock);

	if (ret < 0)

		return;

		return ret;



	ret = kernel_getsockname(qrtr_ns.sock, (struct sockaddr *)&sq);

	if (ret < 0) {
@@ -797,12 +797,13 @@ void qrtr_ns_init(void) 
	if (ret < 0)

		goto err_wq;



	return;

	return 0;



err_wq:

	destroy_workqueue(qrtr_ns.workqueue);

err_sock:

	sock_release(qrtr_ns.sock);

	return ret;

}

EXPORT_SYMBOL_GPL(qrtr_ns_init);

net/qrtr/qrtr.c

+11 −5
Original line number Diff line number Diff line
@@ -1287,13 +1287,19 @@ static int __init qrtr_proto_init(void) 
		return rc;



	rc = sock_register(&qrtr_family);

	if (rc) {

		proto_unregister(&qrtr_proto);

		return rc;

	}

	if (rc)

		goto err_proto;



	qrtr_ns_init();

	rc = qrtr_ns_init();

	if (rc)

		goto err_sock;



	return 0;



err_sock:

	sock_unregister(qrtr_family.family);

err_proto:

	proto_unregister(&qrtr_proto);

	return rc;

}

postcore_initcall(qrtr_proto_init);

net/qrtr/qrtr.h

+1 −1
Original line number Diff line number Diff line
@@ -29,7 +29,7 @@ void qrtr_endpoint_unregister(struct qrtr_endpoint *ep); 


int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len);



void qrtr_ns_init(void);

int qrtr_ns_init(void);



void qrtr_ns_remove(void);