Messages in this thread | | | From | Paul Moore <> | Date | Mon, 30 Aug 2021 10:17:05 -0400 | Subject | Re: [PATCH v2] net: fix NULL pointer reference in cipso_v4_doi_free |
| |
On Mon, Aug 30, 2021 at 6:28 AM 王贇 <yun.wang@linux.alibaba.com> wrote: > > In netlbl_cipsov4_add_std() when 'doi_def->map.std' alloc > failed, we sometime observe panic: > > BUG: kernel NULL pointer dereference, address: > ... > RIP: 0010:cipso_v4_doi_free+0x3a/0x80 > ... > Call Trace: > netlbl_cipsov4_add_std+0xf4/0x8c0 > netlbl_cipsov4_add+0x13f/0x1b0 > genl_family_rcv_msg_doit.isra.15+0x132/0x170 > genl_rcv_msg+0x125/0x240 > > This is because in cipso_v4_doi_free() there is no check > on 'doi_def->map.std' when doi_def->type got value 1, which > is possibe, since netlbl_cipsov4_add_std() haven't initialize > it before alloc 'doi_def->map.std'. > > This patch just add the check to prevent panic happen in similar > cases. > > Reported-by: Abaci <abaci@linux.alibaba.com> > Signed-off-by: Michael Wang <yun.wang@linux.alibaba.com> > --- > net/netlabel/netlabel_cipso_v4.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-)
I see this was already merged, but it looks good to me, thanks for making those changes.
> diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c > index baf2357..344c228 100644 > --- a/net/netlabel/netlabel_cipso_v4.c > +++ b/net/netlabel/netlabel_cipso_v4.c > @@ -144,8 +144,8 @@ static int netlbl_cipsov4_add_std(struct genl_info *info, > return -ENOMEM; > doi_def->map.std = kzalloc(sizeof(*doi_def->map.std), GFP_KERNEL); > if (doi_def->map.std == NULL) { > - ret_val = -ENOMEM; > - goto add_std_failure; > + kfree(doi_def); > + return -ENOMEM; > } > doi_def->type = CIPSO_V4_MAP_TRANS; > > -- > 1.8.3.1
-- paul moore www.paul-moore.com
| |