From f014ff098d53faedb93f5393161120b6464210ff Mon Sep 17 00:00:00 2001 From: dujunbao <14829755+du-junbao@user.noreply.gitee.com> Date: Tue, 22 Sep 2026 21:31:25 +0800 Subject: [PATCH] urma: ubcore: fix the netns error path of the ueid update command ubcore_update_ueid() resolves the net namespace handed in by the caller with get_net_ns_by_fd() and then requires it to be accessible from the device. Both failures share one branch, but the branch only handles the first of them correctly. get_net_ns_by_fd() returns either a valid net pointer or an ERR_PTR. Checking it with IS_ERR() || !ubcore_dev_accessible() mixes the two: when the namespace is valid but not accessible, PTR_ERR() is applied to a valid pointer and the result is returned as the status. That is the truncated address of the pointer rather than an errno, so the caller reports a meaningless value instead of -EPERM. Should the truncation happen to be zero the netlink start callback reports success with cb->args[0] still unset (it was zeroed by __netlink_dump_start()), and the dump callback then passes a NULL context to ubcore_update_uvs_eid_ret(), which dereferences it. The same branch also drops the namespace reference that get_net_ns_by_fd() took, so every rejected request leaks one. Keep the lookup error and the accessibility error separate: return PTR_ERR() only for an invalid pointer, return -EPERM for a valid but inaccessible namespace, and release the reference in the latter case. Fixes: 1e4e6c6a19a4 ("ubcore: add genl, netlink and vtp support to ubcore module.") --- drivers/ub/urma/ubcore/ubcore_genl_admin.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/ub/urma/ubcore/ubcore_genl_admin.c b/drivers/ub/urma/ubcore/ubcore_genl_admin.c index 5b49137efb06..e3e34536a430 100644 --- a/drivers/ub/urma/ubcore/ubcore_genl_admin.c +++ b/drivers/ub/urma/ubcore/ubcore_genl_admin.c @@ -172,9 +172,13 @@ static int ubcore_update_ueid(struct netlink_callback *cb, if (arg.in.ns_fd >= 0) { net = get_net_ns_by_fd(arg.in.ns_fd); if (IS_ERR(net) || !ubcore_dev_accessible(dev, net)) { + int err = IS_ERR(net) ? (int)PTR_ERR(net) : -EPERM; + ubcore_put_device(dev); + if (!IS_ERR(net)) + put_net(net); ubcore_log_err("invalid net ns.\n"); - return (int)PTR_ERR(net); + return err; } } else if (op == UBCORE_MSG_ALLOC_EID) { net = read_pnet(&dev->ldev.net); -- Gitee