All of lore.kernel.org
 help / color / mirror / Atom feed
From: 王贇 <yun.wang@linux.alibaba.com>
To: Paul Moore <paul@paul-moore.com>,
	"David S. Miller" <davem@davemloft.net>,
	Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
	David Ahern <dsahern@kernel.org>,
	Jakub Kicinski <kuba@kernel.org>,
	netdev@vger.kernel.org, linux-security-module@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH] net: fix NULL pointer reference in cipso_v4_doi_free
Date: Mon, 30 Aug 2021 18:14:29 +0800	[thread overview]
Message-ID: <1bf8b84c-416a-8f74-c9de-49f26afbfb84@linux.alibaba.com> (raw)
In-Reply-To: <c6864908-d093-1705-76ce-94d6af85e092@linux.alibaba.com>

Just a ping... Should we fix this?

Regards,
Michael Wang

On 2021/8/26 上午11:42, 王贇 wrote:
> In netlbl_cipsov4_add_std() when 'doi_def->map.std' alloc
> failed, we sometime observe panic:
> 
>   BUG: kernel NULL pointer dereference, address:
>   ...
>   RIP: 0010:cipso_v4_doi_free+0x3a/0x80
>   ...
>   Call Trace:
>    netlbl_cipsov4_add_std+0xf4/0x8c0
>    netlbl_cipsov4_add+0x13f/0x1b0
>    genl_family_rcv_msg_doit.isra.15+0x132/0x170
>    genl_rcv_msg+0x125/0x240
> 
> This is because in cipso_v4_doi_free() there is no check
> on 'doi_def->map.std' when 'doi_def->type' equal 1, which
> is possibe, since netlbl_cipsov4_add_std() haven't initialize
> it before alloc 'doi_def->map.std'.
> 
> This patch just add the check to prevent panic happen for similar
> cases.
> 
> Reported-by: Abaci <abaci@linux.alibaba.com>
> Signed-off-by: Michael Wang <yun.wang@linux.alibaba.com>
> ---
> 
>  net/ipv4/cipso_ipv4.c | 18 ++++++++++--------
>  1 file changed, 10 insertions(+), 8 deletions(-)
> 
> diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
> index 099259f..7fbd0b5 100644
> --- a/net/ipv4/cipso_ipv4.c
> +++ b/net/ipv4/cipso_ipv4.c
> @@ -465,14 +465,16 @@ void cipso_v4_doi_free(struct cipso_v4_doi *doi_def)
>  	if (!doi_def)
>  		return;
> 
> -	switch (doi_def->type) {
> -	case CIPSO_V4_MAP_TRANS:
> -		kfree(doi_def->map.std->lvl.cipso);
> -		kfree(doi_def->map.std->lvl.local);
> -		kfree(doi_def->map.std->cat.cipso);
> -		kfree(doi_def->map.std->cat.local);
> -		kfree(doi_def->map.std);
> -		break;
> +	if (doi_def->map.std) {
> +		switch (doi_def->type) {
> +		case CIPSO_V4_MAP_TRANS:
> +			kfree(doi_def->map.std->lvl.cipso);
> +			kfree(doi_def->map.std->lvl.local);
> +			kfree(doi_def->map.std->cat.cipso);
> +			kfree(doi_def->map.std->cat.local);
> +			kfree(doi_def->map.std);
> +			break;
> +		}
>  	}
>  	kfree(doi_def);
>  }
> 

  parent reply	other threads:[~2021-08-30 10:14 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-08-26  3:42 [PATCH] net: fix NULL pointer reference in cipso_v4_doi_free 王贇
2021-08-27  0:09 ` Paul Moore
2021-08-30 10:20   ` 王贇
2021-08-30 10:14 ` 王贇 [this message]
2021-08-30 10:28 ` [PATCH v2] " 王贇
2021-08-30 11:30   ` patchwork-bot+netdevbpf
2021-08-30 14:17   ` Paul Moore
2021-08-30 16:45     ` Jakub Kicinski
2021-08-30 16:50       ` Paul Moore
2021-08-31  2:41         ` 王贇
2021-08-31 13:48           ` Paul Moore
2021-09-01  1:51             ` 王贇
2021-09-01  9:30               ` David Miller
2021-09-01  9:41                 ` 王贇
2021-09-01 10:45                   ` David Miller
2021-09-02  3:04                     ` 王贇
2021-09-01  2:18   ` [PATCH] Revert "net: fix NULL pointer reference in cipso_v4_doi_free" 王贇
2021-09-01  2:21     ` 王贇
2021-09-01 21:05       ` Paul Moore
2021-09-02  2:37         ` 王贇
2021-09-03  2:15           ` Paul Moore
2021-09-03  2:31             ` 王贇
2021-09-03 14:08               ` Paul Moore
2021-09-03  2:27 ` [PATCH] net: remove the unnecessary check in cipso_v4_doi_free 王贇
2021-09-03 14:08   ` Paul Moore

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1bf8b84c-416a-8f74-c9de-49f26afbfb84@linux.alibaba.com \
    --to=yun.wang@linux.alibaba.com \
    --cc=davem@davemloft.net \
    --cc=dsahern@kernel.org \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=paul@paul-moore.com \
    --cc=yoshfuji@linux-ipv6.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.