• Chen Zhongjin's avatar
    xfrm: Fix ignored return value in xfrm6_init() · 40781bfb
    Chen Zhongjin authored
    When IPv6 module initializing in xfrm6_init(), register_pernet_subsys()
    is possible to fail but its return value is ignored.
    
    If IPv6 initialization fails later and xfrm6_fini() is called,
    removing uninitialized list in xfrm6_net_ops will cause null-ptr-deref:
    
    KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
    CPU: 1 PID: 330 Comm: insmod
    RIP: 0010:unregister_pernet_operations+0xc9/0x450
    Call Trace:
     <TASK>
     unregister_pernet_subsys+0x31/0x3e
     xfrm6_fini+0x16/0x30 [ipv6]
     ip6_route_init+0xcd/0x128 [ipv6]
     inet6_init+0x29c/0x602 [ipv6]
     ...
    
    Fix it by catching the error return value of register_pernet_subsys().
    
    Fixes: 8d068875 ("xfrm: make gc_thresh configurable in all namespaces")
    Signed-off-by: default avatarChen Zhongjin <chenzhongjin@huawei.com>
    Reviewed-by: default avatarLeon Romanovsky <leonro@nvidia.com>
    Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
    40781bfb
xfrm6_policy.c 6.78 KB