Commit 8ca5c1bc authored by Hangbin Liu's avatar Hangbin Liu Committed by Dong Chenchen
Browse files

ipv6: sr: fix invalid unregister error path 

stable inclusion
from stable-v5.10.219
commit 00e6335329f23ac6cf3105931691674e28bc598c
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SHW
CVE: CVE-2024-38612

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=00e6335329f23ac6cf3105931691674e28bc598c



--------------------------------

[ Upstream commit 160e9d2752181fcf18c662e74022d77d3164cd45 ]

The error path of seg6_init() is wrong in case CONFIG_IPV6_SEG6_LWTUNNEL
is not defined. In that case if seg6_hmac_init() fails, the
genl_unregister_family() isn't called.

This issue exist since commit 46738b13 ("ipv6: sr: add option to control
lwtunnel support"), and commit 5559cea2d5aa ("ipv6: sr: fix possible
use-after-free and null-ptr-deref") replaced unregister_pernet_subsys()
with genl_unregister_family() in this error path.

Fixes: 46738b13 ("ipv6: sr: add option to control lwtunnel support")
Reported-by: default avatarGuillaume Nault <gnault@redhat.com>
Signed-off-by: default avatarHangbin Liu <liuhangbin@gmail.com>
Reviewed-by: default avatarSabrina Dubroca <sd@queasysnail.net>
Reviewed-by: default avatarDavid Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20240509131812.1662197-4-liuhangbin@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarDong Chenchen <dongchenchen2@huawei.com>
parent 748eeb7d

net/ipv6/seg6.c

+2 −0
Original line number Diff line number Diff line
@@ -494,6 +494,8 @@ int __init seg6_init(void) 
#endif

#ifdef CONFIG_IPV6_SEG6_LWTUNNEL

out_unregister_genl:

#endif

#if IS_ENABLED(CONFIG_IPV6_SEG6_LWTUNNEL) || IS_ENABLED(CONFIG_IPV6_SEG6_HMAC)

	genl_unregister_family(&seg6_genl_family);

#endif

out_unregister_pernet: