Messages in this thread | | | From | Eric Dumazet <> | Date | Thu, 21 Mar 2024 18:16:30 +0100 | Subject | Re: [PATCH v2] flow_dissector: prevent NULL pointer dereference in __skb_flow_dissect |
| |
On Thu, Mar 21, 2024 at 1:35 PM Anastasia Belova <abelova@astralinux.ru> wrote: > > skb is an optional parameter, so it may be NULL. > Add check defore dereference in eth_hdr. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: 690e36e726d0 ("net: Allow raw buffers to be passed into the flow dissector.") > Signed-off-by: Anastasia Belova <abelova@astralinux.ru> > --- > net/core/flow_dissector.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c > index 272f09251343..68a8228ffae3 100644 > --- a/net/core/flow_dissector.c > +++ b/net/core/flow_dissector.c > @@ -1139,6 +1139,8 @@ bool __skb_flow_dissect(const struct net *net, > > if (dissector_uses_key(flow_dissector, > FLOW_DISSECTOR_KEY_ETH_ADDRS)) { > + if (!skb) > + goto out_bad; > struct ethhdr *eth = eth_hdr(skb); > struct flow_dissector_key_eth_addrs *key_eth_addrs; >
I think you ignored my prior feedback.
In which case can we go to this point with skb == NULL ? How come nobody complained of crashes here ?
I think we need to know if adding code here is useful or not.
You have to understand that a patch like this might need days of work from various teams in the world, flooded by questionable CVE.
| |