]> git.baikalelectronics.ru Git - kernel.git/commit
xfrm: Fix ignored return value in xfrm6_init()
authorChen Zhongjin <chenzhongjin@huawei.com>
Thu, 3 Nov 2022 09:07:13 +0000 (17:07 +0800)
committerSteffen Klassert <steffen.klassert@secunet.com>
Tue, 22 Nov 2022 06:16:34 +0000 (07:16 +0100)
commit08fcc6437526356b4dff88759823b1bcb7fbce3a
tree150e1775dae4bd80677d2c7540de5301bb747b3d
parente437ec717c3f2fb212710658d7466925eda94ab1
xfrm: Fix ignored return value in xfrm6_init()

When IPv6 module initializing in xfrm6_init(), register_pernet_subsys()
is possible to fail but its return value is ignored.

If IPv6 initialization fails later and xfrm6_fini() is called,
removing uninitialized list in xfrm6_net_ops will cause null-ptr-deref:

KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 1 PID: 330 Comm: insmod
RIP: 0010:unregister_pernet_operations+0xc9/0x450
Call Trace:
 <TASK>
 unregister_pernet_subsys+0x31/0x3e
 xfrm6_fini+0x16/0x30 [ipv6]
 ip6_route_init+0xcd/0x128 [ipv6]
 inet6_init+0x29c/0x602 [ipv6]
 ...

Fix it by catching the error return value of register_pernet_subsys().

Fixes: 2d0a7d445546 ("xfrm: make gc_thresh configurable in all namespaces")
Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
net/ipv6/xfrm6_policy.c