From: Jakub Kicinski <kuba@kernel.org>

Date: Mon, 13 Feb 2023 22:53:55 -0800

Subject: net: mpls: fix stale pointer if allocation fails during device rename

Patch-mainline: v6.2

Git-commit: fda6c89fe3d9aca073495a664e1d5aea28cd4377

References: bsc#1208700 CVE-2023-26545

lianhui reports that when MPLS fails to register the sysctl table

under new location (during device rename) the old pointers won't

get overwritten and may be freed again (double free).

Handle this gracefully. The best option would be unregistering

the MPLS from the device completely on failure, but unfortunately

mpls_ifdown() can fail. So failing fully is also unreliable.

Another option is to register the new table first then only

remove old one if the new one succeeds. That requires more

code, changes order of notifications and two tables may be

visible at the same time.

sysctl point is not used in the rest of the code - set to NULL

on failures and skip unregister if already NULL.

Reported-by: lianhui tang <bluetlh@gmail.com>

Fixes: 0fae3bf018d9 ("mpls: handle device renames for per-device sysctls")

Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: David S. Miller <davem@davemloft.net>

Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>

---

 net/mpls/af_mpls.c |    4 ++++

 1 file changed, 4 insertions(+)

--- a/net/mpls/af_mpls.c

+++ b/net/mpls/af_mpls.c

@@ -1428,6 +1428,7 @@ static int mpls_dev_sysctl_register(stru

 free:

 	kfree(table);

 out:

+	mdev->sysctl = NULL;

 	return -ENOBUFS;

 }

@@ -1437,6 +1438,9 @@ static void mpls_dev_sysctl_unregister(s

 	struct net *net = dev_net(dev);

 	struct ctl_table *table;

+	if (!mdev->sysctl)

+		return;

+

 	table = mdev->sysctl->ctl_table_arg;

 	unregister_net_sysctl_table(mdev->sysctl);

 	kfree(table);