genetlink: free the skb on 'group >= family->n_mcgrps'

These methods generally consume ownership of the provided skb, so even
if an error path is encountered, the skb is freed. This is because the
very first thing they do after some initial setup is to unconditionally
consume the skb via consume_skb(skb). Any subsequent errors lead to the
core netlink layer freeing the skb.

However, there is one check that occurs before ownership is passed,
which is the check for the group index. So if this error condition is
encountered, then the skb is leaked. This error condition is generally
considered a violation of the netlink API, so it's not expected to occur
under normal circumstances. For the same reason, no callers check for
this error condition, and no callers need to be adjusted. However, we
should still follow the same ownership semantics of the rest of the
function. Thus, free the skb in this codepath.

Suggested-by: Andrew Lunn <andrew@lunn.ch>
Suggested-by: Matthew Maurer <mmaurer@google.com>
Fixes: 2a94fe48f32c ("genetlink: make multicast groups const, prevent abuse")
Link: https://lore.kernel.org/r/845b36ba-7b3a-41f2-acb2-b284f253e2ca@lunn.ch
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20260506-genlmsg-return-v2-1-a63ee2a055d6@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index 7b84f2cef8b1f9134931394a358fb40b0c6cf98f..d70510ac31ab54888926c98f08b1ea3afce172a2 100644 (file)
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -489,8 +489,10 @@ genlmsg_multicast_netns_filtered(const struct genl_family *family,
                                 netlink_filter_fn filter,
                                 void *filter_data)
 {
-       if (WARN_ON_ONCE(group >= family->n_mcgrps))
+       if (WARN_ON_ONCE(group >= family->n_mcgrps)) {
+               nlmsg_free(skb);
                return -EINVAL;
+       }
        group = family->mcgrp_offset + group;
        return nlmsg_multicast_filtered(net->genl_sock, skb, portid, group,
                                        flags, filter, filter_data);

diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index d251d894afd468b7a8fba11e4fd5760ede55ea5e..0da39eaed255f4736332b84cb31b2793d357d98c 100644 (file)
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -1972,8 +1972,10 @@ int genlmsg_multicast_allns(const struct genl_family *family,
                            struct sk_buff *skb, u32 portid,
                            unsigned int group)
 {
-       if (WARN_ON_ONCE(group >= family->n_mcgrps))
+       if (WARN_ON_ONCE(group >= family->n_mcgrps)) {
+               kfree_skb(skb);
                return -EINVAL;
+       }
 
        group = family->mcgrp_offset + group;
        return genlmsg_mcast(skb, portid, group);
@@ -1986,8 +1988,10 @@ void genl_notify(const struct genl_family *family, struct sk_buff *skb,
        struct net *net = genl_info_net(info);
        struct sock *sk = net->genl_sock;
 
-       if (WARN_ON_ONCE(group >= family->n_mcgrps))
+       if (WARN_ON_ONCE(group >= family->n_mcgrps)) {
+               kfree_skb(skb);
                return;
+       }
 
        group = family->mcgrp_offset + group;
        nlmsg_notify(sk, skb, info->snd_portid, group,