From b3d72d3135d2ef68296c1ee174436efd65386f04 Mon Sep 17 00:00:00 2001

From: Wei Yongjun <weiyongjun1@huawei.com>

Date: Wed, 30 Nov 2022 09:17:05 +0000

Subject: [PATCH] mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()

Git-commit: b3d72d3135d2ef68296c1ee174436efd65386f04

Patch-mainline: v6.1

References: git-fixes

Kernel fault injection test reports null-ptr-deref as follows:

Bug: kernel NULL pointer dereference, address: 0000000000000008

Rip: 0010:cfg802154_netdev_notifier_call+0x120/0x310 include/linux/list.h:114

Call Trace:

 <TASK>

 raw_notifier_call_chain+0x6d/0xa0 kernel/notifier.c:87

 call_netdevice_notifiers_info+0x6e/0xc0 net/core/dev.c:1944

 unregister_netdevice_many_notify+0x60d/0xcb0 net/core/dev.c:1982

 unregister_netdevice_queue+0x154/0x1a0 net/core/dev.c:10879

 register_netdevice+0x9a8/0xb90 net/core/dev.c:10083

 ieee802154_if_add+0x6ed/0x7e0 net/mac802154/iface.c:659

 ieee802154_register_hw+0x29c/0x330 net/mac802154/main.c:229

 mcr20a_probe+0xaaa/0xcb1 drivers/net/ieee802154/mcr20a.c:1316

ieee802154_if_add() allocates wpan_dev as netdev's private data, but not

init the list in struct wpan_dev. cfg802154_netdev_notifier_call() manage

the list when device register/unregister, and may lead to null-ptr-deref.

Use INIT_LIST_HEAD() on it to initialize it correctly.

Fixes: fcf39e6e88e9 ("ieee802154: add wpan_dev_list")

Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>

Acked-by: Alexander Aring <aahringo@redhat.com>

Link: https://lore.kernel.org/r/20221130091705.1831140-1-weiyongjun@huaweicloud.com

Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>

Acked-by: Takashi Iwai <tiwai@suse.de>

---

 net/mac802154/iface.c | 1 +

 1 file changed, 1 insertion(+)

diff --git a/net/mac802154/iface.c b/net/mac802154/iface.c

index 500ed1b81250..7e2065e72915 100644

--- a/net/mac802154/iface.c

+++ b/net/mac802154/iface.c

@@ -662,6 +662,7 @@ ieee802154_if_add(struct ieee802154_local *local, const char *name,

 	sdata->dev = ndev;

 	sdata->wpan_dev.wpan_phy = local->hw.phy;

 	sdata->local = local;

+	INIT_LIST_HEAD(&sdata->wpan_dev.list);

 	/* setup type-dependent data */

 	ret = ieee802154_setup_sdata(sdata, type);

-- 

2.35.3