* [PATCH net 0/2] openvswitch tests for nla_nest_start
@ 2018-07-18 16:12 Stephen Hemminger
2018-07-18 16:12 ` [PATCH net 1/2] openvswitch: check for null return " Stephen Hemminger
` (2 more replies)
0 siblings, 3 replies; 7+ messages in thread
From: Stephen Hemminger @ 2018-07-18 16:12 UTC (permalink / raw)
To: pshelar, davem; +Cc: netdev, dev, Stephen Hemminger
Coverity is looking for bugs here, and a couple of new bugzilla
reports showed up where nla_nest_start return is not checked
for NULL.
Stephen Hemminger (2):
openvswitch: check for null return for nla_nest_start
openvswitch: check for null return for nla_nest_start in datapath
net/openvswitch/conntrack.c | 2 ++
net/openvswitch/datapath.c | 8 ++++++++
2 files changed, 10 insertions(+)
--
2.18.0
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH net 1/2] openvswitch: check for null return for nla_nest_start
2018-07-18 16:12 [PATCH net 0/2] openvswitch tests for nla_nest_start Stephen Hemminger
@ 2018-07-18 16:12 ` Stephen Hemminger
[not found] ` <20180718161216.27820-2-sthemmin-0li6OtcxBFHby3iVrkZq2A@public.gmane.org>
2018-07-18 16:12 ` [PATCH net 2/2] openvswitch: check for null return for nla_nest_start in datapath Stephen Hemminger
2018-07-20 19:15 ` [PATCH net 0/2] openvswitch tests for nla_nest_start David Miller
2 siblings, 1 reply; 7+ messages in thread
From: Stephen Hemminger @ 2018-07-18 16:12 UTC (permalink / raw)
To: pshelar, davem; +Cc: netdev, dev, Stephen Hemminger, Stephen Hemminger
The call to nla_nest_start in conntrack can lead to a NULL
return so it's possible for attr to become NULL and we can potentially
get a NULL pointer dereference on attr. Fix this by checking for
a NULL return.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=200533
Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
net/openvswitch/conntrack.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 284aca2a252d..2e316f641df8 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -2132,6 +2132,8 @@ static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info)
return PTR_ERR(reply);
nla_reply = nla_nest_start(reply, OVS_CT_LIMIT_ATTR_ZONE_LIMIT);
+ if (!nla_reply)
+ return PRT_ERR(-EMSGSIZE);
if (a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) {
err = ovs_ct_limit_get_zone_limit(
--
2.18.0
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH net 2/2] openvswitch: check for null return for nla_nest_start in datapath
2018-07-18 16:12 [PATCH net 0/2] openvswitch tests for nla_nest_start Stephen Hemminger
2018-07-18 16:12 ` [PATCH net 1/2] openvswitch: check for null return " Stephen Hemminger
@ 2018-07-18 16:12 ` Stephen Hemminger
[not found] ` <20180718161216.27820-3-sthemmin-0li6OtcxBFHby3iVrkZq2A@public.gmane.org>
2018-07-20 19:15 ` [PATCH net 0/2] openvswitch tests for nla_nest_start David Miller
2 siblings, 1 reply; 7+ messages in thread
From: Stephen Hemminger @ 2018-07-18 16:12 UTC (permalink / raw)
To: pshelar, davem; +Cc: netdev, dev, Stephen Hemminger, Stephen Hemminger
The call to nla_nest_start when forming packet messages can lead to a NULL
return so it's possible for attr to become NULL and we can potentially
get a NULL pointer dereference on attr. Fix this by checking for
a NULL return.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=200537
Fixes: 8f0aad6f35f7 ("openvswitch: Extend packet attribute for egress tunnel info")
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
net/openvswitch/datapath.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 0f5ce77460d4..93c3eb635827 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -460,6 +460,10 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
if (upcall_info->egress_tun_info) {
nla = nla_nest_start(user_skb, OVS_PACKET_ATTR_EGRESS_TUN_KEY);
+ if (!nla) {
+ err = -EMSGSIZE;
+ goto out;
+ }
err = ovs_nla_put_tunnel_info(user_skb,
upcall_info->egress_tun_info);
BUG_ON(err);
@@ -468,6 +472,10 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
if (upcall_info->actions_len) {
nla = nla_nest_start(user_skb, OVS_PACKET_ATTR_ACTIONS);
+ if (!nla) {
+ err = -EMSGSIZE;
+ goto out;
+ }
err = ovs_nla_put_actions(upcall_info->actions,
upcall_info->actions_len,
user_skb);
--
2.18.0
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH net 1/2] openvswitch: check for null return for nla_nest_start
[not found] ` <20180718161216.27820-2-sthemmin-0li6OtcxBFHby3iVrkZq2A@public.gmane.org>
@ 2018-07-19 6:49 ` Pravin Shelar
0 siblings, 0 replies; 7+ messages in thread
From: Pravin Shelar @ 2018-07-19 6:49 UTC (permalink / raw)
To: Stephen Hemminger
Cc: ovs dev, Linux Kernel Network Developers, Stephen Hemminger,
David S. Miller
On Wed, Jul 18, 2018 at 9:12 AM, Stephen Hemminger
<stephen-OTpzqLSitTUnbdJkjeBofR2eb7JE58TQ@public.gmane.org> wrote:
> The call to nla_nest_start in conntrack can lead to a NULL
> return so it's possible for attr to become NULL and we can potentially
> get a NULL pointer dereference on attr. Fix this by checking for
> a NULL return.
>
> Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=200533
> Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
> Signed-off-by: Stephen Hemminger <stephen-OTpzqLSitTUnbdJkjeBofR2eb7JE58TQ@public.gmane.org>
> ---
> net/openvswitch/conntrack.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
> index 284aca2a252d..2e316f641df8 100644
> --- a/net/openvswitch/conntrack.c
> +++ b/net/openvswitch/conntrack.c
> @@ -2132,6 +2132,8 @@ static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info)
> return PTR_ERR(reply);
>
> nla_reply = nla_nest_start(reply, OVS_CT_LIMIT_ATTR_ZONE_LIMIT);
> + if (!nla_reply)
> + return PRT_ERR(-EMSGSIZE);
>
> if (a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) {
> err = ovs_ct_limit_get_zone_limit(
> --
Acked-by: Pravin B Shelar <pshelar-LZ6Gd1LRuIk@public.gmane.org>
Thanks.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH net 2/2] openvswitch: check for null return for nla_nest_start in datapath
[not found] ` <20180718161216.27820-3-sthemmin-0li6OtcxBFHby3iVrkZq2A@public.gmane.org>
@ 2018-07-19 6:49 ` Pravin Shelar
0 siblings, 0 replies; 7+ messages in thread
From: Pravin Shelar @ 2018-07-19 6:49 UTC (permalink / raw)
To: Stephen Hemminger
Cc: ovs dev, Linux Kernel Network Developers, Stephen Hemminger,
David S. Miller
On Wed, Jul 18, 2018 at 9:12 AM, Stephen Hemminger
<stephen-OTpzqLSitTUnbdJkjeBofR2eb7JE58TQ@public.gmane.org> wrote:
> The call to nla_nest_start when forming packet messages can lead to a NULL
> return so it's possible for attr to become NULL and we can potentially
> get a NULL pointer dereference on attr. Fix this by checking for
> a NULL return.
>
> Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=200537
> Fixes: 8f0aad6f35f7 ("openvswitch: Extend packet attribute for egress tunnel info")
> Signed-off-by: Stephen Hemminger <stephen-OTpzqLSitTUnbdJkjeBofR2eb7JE58TQ@public.gmane.org>
> ---
> net/openvswitch/datapath.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
> index 0f5ce77460d4..93c3eb635827 100644
> --- a/net/openvswitch/datapath.c
> +++ b/net/openvswitch/datapath.c
> @@ -460,6 +460,10 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
>
> if (upcall_info->egress_tun_info) {
> nla = nla_nest_start(user_skb, OVS_PACKET_ATTR_EGRESS_TUN_KEY);
> + if (!nla) {
> + err = -EMSGSIZE;
> + goto out;
> + }
> err = ovs_nla_put_tunnel_info(user_skb,
> upcall_info->egress_tun_info);
> BUG_ON(err);
> @@ -468,6 +472,10 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
>
> if (upcall_info->actions_len) {
> nla = nla_nest_start(user_skb, OVS_PACKET_ATTR_ACTIONS);
> + if (!nla) {
> + err = -EMSGSIZE;
> + goto out;
> + }
> err = ovs_nla_put_actions(upcall_info->actions,
> upcall_info->actions_len,
> user_skb);
Acked-by: Pravin B Shelar <pshelar-LZ6Gd1LRuIk@public.gmane.org>
Thanks.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH net 0/2] openvswitch tests for nla_nest_start
2018-07-18 16:12 [PATCH net 0/2] openvswitch tests for nla_nest_start Stephen Hemminger
2018-07-18 16:12 ` [PATCH net 1/2] openvswitch: check for null return " Stephen Hemminger
2018-07-18 16:12 ` [PATCH net 2/2] openvswitch: check for null return for nla_nest_start in datapath Stephen Hemminger
@ 2018-07-20 19:15 ` David Miller
2018-07-20 19:19 ` David Miller
2 siblings, 1 reply; 7+ messages in thread
From: David Miller @ 2018-07-20 19:15 UTC (permalink / raw)
To: stephen; +Cc: pshelar, netdev, dev, sthemmin
From: Stephen Hemminger <stephen@networkplumber.org>
Date: Wed, 18 Jul 2018 09:12:14 -0700
> Coverity is looking for bugs here, and a couple of new bugzilla
> reports showed up where nla_nest_start return is not checked
> for NULL.
Series applied and patch #2 queued up for -stable, thanks Stephen.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH net 0/2] openvswitch tests for nla_nest_start
2018-07-20 19:15 ` [PATCH net 0/2] openvswitch tests for nla_nest_start David Miller
@ 2018-07-20 19:19 ` David Miller
0 siblings, 0 replies; 7+ messages in thread
From: David Miller @ 2018-07-20 19:19 UTC (permalink / raw)
To: stephen; +Cc: pshelar, netdev, dev, sthemmin
From: David Miller <davem@davemloft.net>
Date: Fri, 20 Jul 2018 12:15:36 -0700 (PDT)
> From: Stephen Hemminger <stephen@networkplumber.org>
> Date: Wed, 18 Jul 2018 09:12:14 -0700
>
>> Coverity is looking for bugs here, and a couple of new bugzilla
>> reports showed up where nla_nest_start return is not checked
>> for NULL.
>
> Series applied and patch #2 queued up for -stable, thanks Stephen.
Actually, this wasn't compile tested and fails to build. :-/
Please fix this and resubmit.
Thanks.
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2018-07-20 20:08 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-07-18 16:12 [PATCH net 0/2] openvswitch tests for nla_nest_start Stephen Hemminger
2018-07-18 16:12 ` [PATCH net 1/2] openvswitch: check for null return " Stephen Hemminger
[not found] ` <20180718161216.27820-2-sthemmin-0li6OtcxBFHby3iVrkZq2A@public.gmane.org>
2018-07-19 6:49 ` Pravin Shelar
2018-07-18 16:12 ` [PATCH net 2/2] openvswitch: check for null return for nla_nest_start in datapath Stephen Hemminger
[not found] ` <20180718161216.27820-3-sthemmin-0li6OtcxBFHby3iVrkZq2A@public.gmane.org>
2018-07-19 6:49 ` Pravin Shelar
2018-07-20 19:15 ` [PATCH net 0/2] openvswitch tests for nla_nest_start David Miller
2018-07-20 19:19 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).