Re: [PATCH net] net: hsr: fix NULL deref in hsr_get_node_data

[Xiang Mei]

Thanks for pointing me to the patch. Their patch fixed the issue.

On Tue, May 12, 2026 at 3:46 AM Simon Horman <horms@xxxxxxxxxx> wrote:
>
> On Mon, May 11, 2026 at 12:15:17AM -0700, Xiang Mei wrote:
> > hsr_get_node_data() looks up a node's address-B port and dereferences
> > port->dev->ifindex without checking the return value of
> > hsr_port_get_hsr(), which returns NULL when no port of the requested
> > type is currently attached.
> >
> > node->addr_B_port is set by hsr_handle_sup_frame() on every supervision
> > frame but is never cleared when the corresponding slave is removed.
> > If one slave of an HSR master is unregistered while the master stays
> > alive (the other slave keeps it up), node_db entries retain a stale
> > addr_B_port. An unprivileged HSR_C_GET_NODE_STATUS query (genl op has
> > .flags = 0) then crashes the kernel:
> >
> >   Oops: general protection fault, probably for non-canonical address
> >   0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
> >   KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
> >   RIP: 0010:hsr_get_node_data (net/hsr/hsr_framereg.c:892)
> >   Call Trace:
> >    hsr_get_node_status (net/hsr/hsr_netlink.c:366)
> >    genl_family_rcv_msg_doit (net/netlink/genetlink.c:1114)
> >    genl_rcv_msg (net/netlink/genetlink.c:1209)
> >    netlink_rcv_skb (net/netlink/af_netlink.c:2550)
> >    netlink_unicast (net/netlink/af_netlink.c:1344)
> >    netlink_sendmsg (net/netlink/af_netlink.c:1894)
> >    __sys_sendto (net/socket.c:2265)
> >
> > Default *addr_b_ifindex to -1 and only overwrite it when the port
> > lookup succeeds. The caller hsr_get_node_status() already treats
> > addr_b_ifindex == -1 as "no address-B port" when emitting the
> > HSR_A_NODE_ADDR_B / HSR_A_ADDR_B_IFINDEX attributes, so behavior is
> > unchanged for valid setups.
> >
> > Fixes: c5a759117210 ("net/hsr: Use list_head (and rcu) instead of array for slave devices.")
> > Reported-by: Weiming Shi <bestswngs@xxxxxxxxx>
> > Assisted-by: Claude:claude-opus-4-7
> > Signed-off-by: Xiang Mei <xmei5@xxxxxxx>
>
> Hi,
>
> Thanks for your patch.  It appears to address the same issue as the
> following commit which was recently added to net.
>
> Here is the summary with links:
>   - [net] net: hsr: fix NULL pointer dereference in hsr_get_node_data()
>     https://git.kernel.org/netdev/net/c/911f54771ca9
>
> Although that code-changes there differ from this patch,
> I believe the overall logic is the same.
>
> Please consider an incremental patch if you think the commit above
> is insufficient for some reason.
>
> --
> pw-bot: changes-requested