Patch "net: qrtr: fix null-ptr-deref in qrtr_ns_remove" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net: qrtr: fix null-ptr-deref in qrtr_ns_remove

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-qrtr-fix-null-ptr-deref-in-qrtr_ns_remove.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 7e61f428c3d0b74fe130f64a848bdb2731f25100
Author: Qinglang Miao <miaoqinglang@xxxxxxxxxx>
Date:   Tue Jan 5 13:57:54 2021 +0800

    net: qrtr: fix null-ptr-deref in qrtr_ns_remove
    
    [ Upstream commit 4beb17e553b49c3dd74505c9f361e756aaae653e ]
    
    A null-ptr-deref bug is reported by Hulk Robot like this:
    --------------
    KASAN: null-ptr-deref in range [0x0000000000000128-0x000000000000012f]
    Call Trace:
    qrtr_ns_remove+0x22/0x40 [ns]
    qrtr_proto_fini+0xa/0x31 [qrtr]
    __x64_sys_delete_module+0x337/0x4e0
    do_syscall_64+0x34/0x80
    entry_SYSCALL_64_after_hwframe+0x44/0xa9
    RIP: 0033:0x468ded
    --------------
    
    When qrtr_ns_init fails in qrtr_proto_init, qrtr_ns_remove which would
    be called later on would raise a null-ptr-deref because qrtr_ns.workqueue
    has been destroyed.
    
    Fix it by making qrtr_ns_init have a return value and adding a check in
    qrtr_proto_init.
    
    Reported-by: Hulk Robot <hulkci@xxxxxxxxxx>
    Signed-off-by: Qinglang Miao <miaoqinglang@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Stable-dep-of: fd76e5ccc48f ("net: qrtr: ns: Fix module refcnt")
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c
index 71c2295d4a573..29c0886eb9efe 100644
--- a/net/qrtr/af_qrtr.c
+++ b/net/qrtr/af_qrtr.c
@@ -1279,13 +1279,19 @@ static int __init qrtr_proto_init(void)
 		return rc;
 
 	rc = sock_register(&qrtr_family);
-	if (rc) {
-		proto_unregister(&qrtr_proto);
-		return rc;
-	}
+	if (rc)
+		goto err_proto;
 
-	qrtr_ns_init();
+	rc = qrtr_ns_init();
+	if (rc)
+		goto err_sock;
 
+	return 0;
+
+err_sock:
+	sock_unregister(qrtr_family.family);
+err_proto:
+	proto_unregister(&qrtr_proto);
 	return rc;
 }
 postcore_initcall(qrtr_proto_init);
diff --git a/net/qrtr/ns.c b/net/qrtr/ns.c
index c92dd960bfefa..3376a656da39f 100644
--- a/net/qrtr/ns.c
+++ b/net/qrtr/ns.c
@@ -771,7 +771,7 @@ static void qrtr_ns_data_ready(struct sock *sk)
 	queue_work(qrtr_ns.workqueue, &qrtr_ns.work);
 }
 
-void qrtr_ns_init(void)
+int qrtr_ns_init(void)
 {
 	struct sockaddr_qrtr sq;
 	int ret;
@@ -782,7 +782,7 @@ void qrtr_ns_init(void)
 	ret = sock_create_kern(&init_net, AF_QIPCRTR, SOCK_DGRAM,
 			       PF_QIPCRTR, &qrtr_ns.sock);
 	if (ret < 0)
-		return;
+		return ret;
 
 	ret = kernel_getsockname(qrtr_ns.sock, (struct sockaddr *)&sq);
 	if (ret < 0) {
@@ -815,12 +815,13 @@ void qrtr_ns_init(void)
 	if (ret < 0)
 		goto err_wq;
 
-	return;
+	return 0;
 
 err_wq:
 	destroy_workqueue(qrtr_ns.workqueue);
 err_sock:
 	sock_release(qrtr_ns.sock);
+	return ret;
 }
 EXPORT_SYMBOL_GPL(qrtr_ns_init);
 
diff --git a/net/qrtr/qrtr.h b/net/qrtr/qrtr.h
index dc2b67f179271..3f2d28696062a 100644
--- a/net/qrtr/qrtr.h
+++ b/net/qrtr/qrtr.h
@@ -29,7 +29,7 @@ void qrtr_endpoint_unregister(struct qrtr_endpoint *ep);
 
 int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len);
 
-void qrtr_ns_init(void);
+int qrtr_ns_init(void);
 
 void qrtr_ns_remove(void);