mirror of
https://github.com/torvalds/linux
synced 2024-07-21 18:51:47 +00:00
4beb17e553
A null-ptr-deref bug is reported by Hulk Robot like this: -------------- KASAN: null-ptr-deref in range [0x0000000000000128-0x000000000000012f] Call Trace: qrtr_ns_remove+0x22/0x40 [ns] qrtr_proto_fini+0xa/0x31 [qrtr] __x64_sys_delete_module+0x337/0x4e0 do_syscall_64+0x34/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x468ded -------------- When qrtr_ns_init fails in qrtr_proto_init, qrtr_ns_remove which would be called later on would raise a null-ptr-deref because qrtr_ns.workqueue has been destroyed. Fix it by making qrtr_ns_init have a return value and adding a check in qrtr_proto_init. Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
37 lines
916 B
C
37 lines
916 B
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef __QRTR_H_
|
|
#define __QRTR_H_
|
|
|
|
#include <linux/types.h>
|
|
|
|
struct sk_buff;
|
|
|
|
/* endpoint node id auto assignment */
|
|
#define QRTR_EP_NID_AUTO (-1)
|
|
|
|
/**
|
|
* struct qrtr_endpoint - endpoint handle
|
|
* @xmit: Callback for outgoing packets
|
|
*
|
|
* The socket buffer passed to the xmit function becomes owned by the endpoint
|
|
* driver. As such, when the driver is done with the buffer, it should
|
|
* call kfree_skb() on failure, or consume_skb() on success.
|
|
*/
|
|
struct qrtr_endpoint {
|
|
int (*xmit)(struct qrtr_endpoint *ep, struct sk_buff *skb);
|
|
/* private: not for endpoint use */
|
|
struct qrtr_node *node;
|
|
};
|
|
|
|
int qrtr_endpoint_register(struct qrtr_endpoint *ep, unsigned int nid);
|
|
|
|
void qrtr_endpoint_unregister(struct qrtr_endpoint *ep);
|
|
|
|
int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len);
|
|
|
|
int qrtr_ns_init(void);
|
|
|
|
void qrtr_ns_remove(void);
|
|
|
|
#endif
|