* [PATCH v2] ipv6/sit: fix ipip6_tunnel_get_prl when memory allocation fails
@ 2022-06-25 5:45 zys.zljxml
2022-06-26 17:15 ` David Ahern
2022-06-27 9:01 ` Eric Dumazet
0 siblings, 2 replies; 4+ messages in thread
From: zys.zljxml @ 2022-06-25 5:45 UTC (permalink / raw)
To: linux-kernel, netdev, yoshfuji, dsahern
Cc: kuba, davem, edumazet, eric.dumazet, pabeni, katrinzhou
From: katrinzhou <katrinzhou@tencent.com>
Fix an illegal copy_to_user() attempt when the system fails to
allocate memory for prl due to a lack of memory.
Addresses-Coverity: ("Unused value")
Fixes: 300aaeeaab5f ("[IPV6] SIT: Add SIOCGETPRL ioctl to get/dump PRL.")
Signed-off-by: katrinzhou <katrinzhou@tencent.com>
---
Changes in v2:
- Move the position of label "out"
net/ipv6/sit.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index c0b138c20992..3330882c0f94 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -323,8 +323,6 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
kcalloc(cmax, sizeof(*kp), GFP_KERNEL_ACCOUNT | __GFP_NOWARN) :
NULL;
- rcu_read_lock();
-
ca = min(t->prl_count, cmax);
if (!kp) {
@@ -342,6 +340,7 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
}
c = 0;
+ rcu_read_lock();
for_each_prl_rcu(t->prl) {
if (c >= cmax)
break;
@@ -353,7 +352,7 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
if (kprl.addr != htonl(INADDR_ANY))
break;
}
-out:
+
rcu_read_unlock();
len = sizeof(*kp) * c;
@@ -362,7 +361,7 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
ret = -EFAULT;
kfree(kp);
-
+out:
return ret;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v2] ipv6/sit: fix ipip6_tunnel_get_prl when memory allocation fails
2022-06-25 5:45 [PATCH v2] ipv6/sit: fix ipip6_tunnel_get_prl when memory allocation fails zys.zljxml
@ 2022-06-26 17:15 ` David Ahern
2022-06-27 9:01 ` Eric Dumazet
1 sibling, 0 replies; 4+ messages in thread
From: David Ahern @ 2022-06-26 17:15 UTC (permalink / raw)
To: zys.zljxml, linux-kernel, netdev, yoshfuji
Cc: kuba, davem, edumazet, eric.dumazet, pabeni, katrinzhou
On 6/24/22 11:45 PM, zys.zljxml@gmail.com wrote:
> From: katrinzhou <katrinzhou@tencent.com>
>
> Fix an illegal copy_to_user() attempt when the system fails to
> allocate memory for prl due to a lack of memory.
>
> Addresses-Coverity: ("Unused value")
> Fixes: 300aaeeaab5f ("[IPV6] SIT: Add SIOCGETPRL ioctl to get/dump PRL.")
> Signed-off-by: katrinzhou <katrinzhou@tencent.com>
> ---
>
> Changes in v2:
> - Move the position of label "out"
>
> net/ipv6/sit.c | 7 +++----
> 1 file changed, 3 insertions(+), 4 deletions(-)
>
Reviewed-by: David Ahern <dsahern@kernel.org>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] ipv6/sit: fix ipip6_tunnel_get_prl when memory allocation fails
2022-06-25 5:45 [PATCH v2] ipv6/sit: fix ipip6_tunnel_get_prl when memory allocation fails zys.zljxml
2022-06-26 17:15 ` David Ahern
@ 2022-06-27 9:01 ` Eric Dumazet
2022-06-27 11:18 ` Katrin Jo
1 sibling, 1 reply; 4+ messages in thread
From: Eric Dumazet @ 2022-06-27 9:01 UTC (permalink / raw)
To: zys.zljxml
Cc: LKML, netdev, Hideaki YOSHIFUJI, David Ahern, Jakub Kicinski,
David Miller, Eric Dumazet, Paolo Abeni, katrinzhou
On Sat, Jun 25, 2022 at 7:45 AM <zys.zljxml@gmail.com> wrote:
>
> From: katrinzhou <katrinzhou@tencent.com>
>
> Fix an illegal copy_to_user() attempt when the system fails to
> allocate memory for prl due to a lack of memory.
I do not really see an illegal copy_to_user()
c = 0
-> len = 0
if ((len && copy_to_user(a + 1, kp, len)) || put_user(len, &a->datalen))
So the copy_to_user() should not be called ?
I think you should only mention that after this patch, correct error
code is returned (-ENOMEM)
>
> Addresses-Coverity: ("Unused value")
> Fixes: 300aaeeaab5f ("[IPV6] SIT: Add SIOCGETPRL ioctl to get/dump PRL.")
> Signed-off-by: katrinzhou <katrinzhou@tencent.com>
> ---
>
> Changes in v2:
> - Move the position of label "out"
>
> net/ipv6/sit.c | 7 +++----
> 1 file changed, 3 insertions(+), 4 deletions(-)
>
> diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
> index c0b138c20992..3330882c0f94 100644
> --- a/net/ipv6/sit.c
> +++ b/net/ipv6/sit.c
> @@ -323,8 +323,6 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> kcalloc(cmax, sizeof(*kp), GFP_KERNEL_ACCOUNT | __GFP_NOWARN) :
> NULL;
>
> - rcu_read_lock();
> -
> ca = min(t->prl_count, cmax);
>
> if (!kp) {
> @@ -342,6 +340,7 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> }
>
> c = 0;
> + rcu_read_lock();
> for_each_prl_rcu(t->prl) {
> if (c >= cmax)
> break;
> @@ -353,7 +352,7 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> if (kprl.addr != htonl(INADDR_ANY))
> break;
> }
> -out:
> +
> rcu_read_unlock();
>
> len = sizeof(*kp) * c;
> @@ -362,7 +361,7 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> ret = -EFAULT;
>
> kfree(kp);
> -
> +out:
> return ret;
> }
>
> --
> 2.27.0
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] ipv6/sit: fix ipip6_tunnel_get_prl when memory allocation fails
2022-06-27 9:01 ` Eric Dumazet
@ 2022-06-27 11:18 ` Katrin Jo
0 siblings, 0 replies; 4+ messages in thread
From: Katrin Jo @ 2022-06-27 11:18 UTC (permalink / raw)
To: Eric Dumazet
Cc: LKML, netdev, Hideaki YOSHIFUJI, David Ahern, Jakub Kicinski,
David Miller, Eric Dumazet, Paolo Abeni, katrinzhou
On Mon, Jun 27, 2022 at 5:01 PM Eric Dumazet <edumazet@google.com> wrote:
>
> On Sat, Jun 25, 2022 at 7:45 AM <zys.zljxml@gmail.com> wrote:
> >
> > From: katrinzhou <katrinzhou@tencent.com>
> >
> > Fix an illegal copy_to_user() attempt when the system fails to
> > allocate memory for prl due to a lack of memory.
>
> I do not really see an illegal copy_to_user()
>
> c = 0
> -> len = 0
>
> if ((len && copy_to_user(a + 1, kp, len)) || put_user(len, &a->datalen))
>
> So the copy_to_user() should not be called ?
>
> I think you should only mention that after this patch, correct error
> code is returned (-ENOMEM)
>
>
> >
> > Addresses-Coverity: ("Unused value")
> > Fixes: 300aaeeaab5f ("[IPV6] SIT: Add SIOCGETPRL ioctl to get/dump PRL.")
> > Signed-off-by: katrinzhou <katrinzhou@tencent.com>
> > ---
> >
> > Changes in v2:
> > - Move the position of label "out"
> >
> > net/ipv6/sit.c | 7 +++----
> > 1 file changed, 3 insertions(+), 4 deletions(-)
> >
> > diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
> > index c0b138c20992..3330882c0f94 100644
> > --- a/net/ipv6/sit.c
> > +++ b/net/ipv6/sit.c
> > @@ -323,8 +323,6 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> > kcalloc(cmax, sizeof(*kp), GFP_KERNEL_ACCOUNT | __GFP_NOWARN) :
> > NULL;
> >
> > - rcu_read_lock();
> > -
> > ca = min(t->prl_count, cmax);
> >
> > if (!kp) {
> > @@ -342,6 +340,7 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> > }
> >
> > c = 0;
> > + rcu_read_lock();
> > for_each_prl_rcu(t->prl) {
> > if (c >= cmax)
> > break;
> > @@ -353,7 +352,7 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> > if (kprl.addr != htonl(INADDR_ANY))
> > break;
> > }
> > -out:
> > +
> > rcu_read_unlock();
> >
> > len = sizeof(*kp) * c;
> > @@ -362,7 +361,7 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> > ret = -EFAULT;
> >
> > kfree(kp);
> > -
> > +out:
> > return ret;
> > }
> >
> > --
> > 2.27.0
> >
Thanks for pointing that out. I will modify the message in the next
version of the patch.
And, could c = 0 (line 344) be removed? It is initialized at the beginning.
I think it is a cleanup work.
Best Regards,
Katrin
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-06-27 11:18 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-06-25 5:45 [PATCH v2] ipv6/sit: fix ipip6_tunnel_get_prl when memory allocation fails zys.zljxml
2022-06-26 17:15 ` David Ahern
2022-06-27 9:01 ` Eric Dumazet
2022-06-27 11:18 ` Katrin Jo
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.