[PATCH] net-sysfs: fix NULL pointer dereference

From: Qasim Ijaz
Date: Wed Mar 05 2025 - 18:53:59 EST


Commit <79c61899b5ee> introduces a potential NULL pointer dereference
in the sysfs_rtnl_lock() function when initialising kn:

kn = sysfs_break_active_protection(kobj, attr);

The commit overlooks the fact that sysfs_break_active_protection can
return NULL if kernfs_find_and_get() fails to find and get the kernfs_node
with the given name.

Later on the code calls sysfs_unbreak_active_protection(kn)
unconditionally, which could lead to a NULL pointer dereference.

Resolve this bug by introducing a NULL check before using kn
in the sysfs_unbreak_active_protection() call.

Signed-off-by: Qasim Ijaz <qasdev00@xxxxxxxxx>
Fixes: 79c61899b5ee ("net-sysfs: remove rtnl_trylock from device attributes")
---
net/core/net-sysfs.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 8d9dc048a548..c5085588e536 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -117,7 +117,8 @@ static int sysfs_rtnl_lock(struct kobject *kobj, struct attribute *attr,
* the rtnl lock.
*/
unbreak:
- sysfs_unbreak_active_protection(kn);
+ if (kn)
+ sysfs_unbreak_active_protection(kn);
dev_put(ndev);

return ret;
--
2.39.5