• Qinglang Miao's avatar
    net: qrtr: fix null-ptr-deref in qrtr_ns_remove · 4beb17e5
    Qinglang Miao authored
    A null-ptr-deref bug is reported by Hulk Robot like this:
    --------------
    KASAN: null-ptr-deref in range [0x0000000000000128-0x000000000000012f]
    Call Trace:
    qrtr_ns_remove+0x22/0x40 [ns]
    qrtr_proto_fini+0xa/0x31 [qrtr]
    __x64_sys_delete_module+0x337/0x4e0
    do_syscall_64+0x34/0x80
    entry_SYSCALL_64_after_hwframe+0x44/0xa9
    RIP: 0033:0x468ded
    --------------
    
    When qrtr_ns_init fails in qrtr_proto_init, qrtr_ns_remove which would
    be called later on would raise a null-ptr-deref because qrtr_ns.workqueue
    has been destroyed.
    
    Fix it by making qrtr_ns_init have a return value and adding a check in
    qrtr_proto_init.
    Reported-by: default avatarHulk Robot <hulkci@huawei.com>
    Signed-off-by: default avatarQinglang Miao <miaoqinglang@huawei.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    4beb17e5
qrtr.c 30.1 KB