[ovs-dev] [PATCH] netdev-linux: Fix a null pointer dereference in netdev_linux_notify_sock()

[David Marchand]

On Wed, Sep 8, 2021 at 1:53 PM Yunjian Wang <wangyunjian at huawei.com> wrote:
>
> If nl_sock_join_mcgroup() returns an error, the 'sock' is freed
> and set to NULL. So we should add NULL check of 'sock' before calling
> nl_sock_listen_all_nsid().
>
> Fixes: cf114a7fce80 ("netlink linux: enable listening to all nsids")
> Cc: Flavio Leitner <fbl at redhat.com>
> Signed-off-by: Yunjian Wang <wangyunjian at huawei.com>
> ---
>  lib/netdev-linux.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/lib/netdev-linux.c b/lib/netdev-linux.c
> index 60dd13891..7fec5f5a6 100644
> --- a/lib/netdev-linux.c
> +++ b/lib/netdev-linux.c
> @@ -636,7 +636,9 @@ netdev_linux_notify_sock(void)
>                  }
>              }
>          }
> -        nl_sock_listen_all_nsid(sock, true);
> +        if (sock) {
> +            nl_sock_listen_all_nsid(sock, true);
> +        }
>          ovsthread_once_done(&once);
>      }
>

Would it make sense to move this call before the loop on groups?
Something like:

@@ -627,6 +627,7 @@ netdev_linux_notify_sock(void)
         if (!error) {
             size_t i;

+            nl_sock_listen_all_nsid(sock, true);
             for (i = 0; i < ARRAY_SIZE(mcgroups); i++) {
                 error = nl_sock_join_mcgroup(sock, mcgroups[i]);
                 if (error) {
@@ -636,7 +637,6 @@ netdev_linux_notify_sock(void)
                 }
             }
         }
-        nl_sock_listen_all_nsid(sock, true);
         ovsthread_once_done(&once);
     }


-- 
David Marchand