* [PATCH] Fix null pointer dereference in vector_user_bpf
@ 2020-06-10 3:43 Gaurav Singh
2020-06-10 5:53 ` Greg KH
0 siblings, 1 reply; 5+ messages in thread
From: Gaurav Singh @ 2020-06-10 3:43 UTC (permalink / raw)
To: gaurav1086, Jeff Dike, Richard Weinberger, Anton Ivanov,
Alexei Starovoitov, Daniel Borkmann, Martin KaFai Lau, Song Liu,
Yonghong Song, Andrii Nakryiko, John Fastabend, KP Singh,
Alex Dewar, open list:USER-MODE LINUX (UML),
open list, open list:BPF (Safe dynamic programs and tools),
open list:BPF (Safe dynamic programs and tools)
Signed-off-by: Gaurav Singh <gaurav1086@gmail.com>
The bpf_prog is being checked for !NULL after uml_kmalloc but
later its used directly for example:
bpf_prog->filter = bpf and is also later returned upon success.
Fix this, do a NULL check and return right away.
---
arch/um/drivers/vector_user.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/arch/um/drivers/vector_user.c b/arch/um/drivers/vector_user.c
index aa28e9eecb7b..71d043ae306f 100644
--- a/arch/um/drivers/vector_user.c
+++ b/arch/um/drivers/vector_user.c
@@ -730,10 +730,12 @@ void *uml_vector_user_bpf(char *filename)
return false;
}
bpf_prog = uml_kmalloc(sizeof(struct sock_fprog), UM_GFP_KERNEL);
- if (bpf_prog != NULL) {
- bpf_prog->len = statbuf.st_size / sizeof(struct sock_filter);
- bpf_prog->filter = NULL;
+ if (bpf_prog == NULL) {
+ printk(KERN_ERR "Failed to allocate bpf prog buffer");
+ return NULL;
}
+ bpf_prog->len = statbuf.st_size / sizeof(struct sock_filter);
+ bpf_prog->filter = NULL;
ffd = os_open_file(filename, of_read(OPENFLAGS()), 0);
if (ffd < 0) {
printk(KERN_ERR "Error %d opening bpf file", -errno);
--
2.17.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] Fix null pointer dereference in vector_user_bpf
2020-06-10 3:43 [PATCH] Fix null pointer dereference in vector_user_bpf Gaurav Singh
@ 2020-06-10 5:53 ` Greg KH
0 siblings, 0 replies; 5+ messages in thread
From: Greg KH @ 2020-06-10 5:53 UTC (permalink / raw)
To: Gaurav Singh
Cc: Jeff Dike, Richard Weinberger, Anton Ivanov, Alexei Starovoitov,
Daniel Borkmann, Martin KaFai Lau, Song Liu, Yonghong Song,
Andrii Nakryiko, John Fastabend, KP Singh, Alex Dewar,
open list:USER-MODE LINUX (UML),
open list, open list:BPF (Safe dynamic programs and tools),
open list:BPF (Safe dynamic programs and tools)
On Tue, Jun 09, 2020 at 11:43:00PM -0400, Gaurav Singh wrote:
> Signed-off-by: Gaurav Singh <gaurav1086@gmail.com>
>
> The bpf_prog is being checked for !NULL after uml_kmalloc but
> later its used directly for example:
> bpf_prog->filter = bpf and is also later returned upon success.
> Fix this, do a NULL check and return right away.
>
> ---
> arch/um/drivers/vector_user.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
No signed-off-by?
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH] Fix null pointer dereference in vector_user_bpf
@ 2020-06-11 2:40 Gaurav Singh
0 siblings, 0 replies; 5+ messages in thread
From: Gaurav Singh @ 2020-06-11 2:40 UTC (permalink / raw)
To: gaurav1086, Jeff Dike, Richard Weinberger, Anton Ivanov,
Alexei Starovoitov, Daniel Borkmann, Martin KaFai Lau, Song Liu,
Yonghong Song, Andrii Nakryiko, John Fastabend, KP Singh,
Alex Dewar, open list:USER-MODE LINUX (UML),
open list, open list:BPF (Safe dynamic programs and tools),
open list:BPF (Safe dynamic programs and tools)
The bpf_prog is being checked for !NULL after uml_kmalloc but
later its used directly for example:
bpf_prog->filter = bpf and is also later returned upon success.
Fix this, do a NULL check and return right away.
Signed-off-by: Gaurav Singh <gaurav1086@gmail.com>
---
arch/um/drivers/vector_user.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/arch/um/drivers/vector_user.c b/arch/um/drivers/vector_user.c
index aa28e9eecb7b..71d043ae306f 100644
--- a/arch/um/drivers/vector_user.c
+++ b/arch/um/drivers/vector_user.c
@@ -730,10 +730,12 @@ void *uml_vector_user_bpf(char *filename)
return false;
}
bpf_prog = uml_kmalloc(sizeof(struct sock_fprog), UM_GFP_KERNEL);
- if (bpf_prog != NULL) {
- bpf_prog->len = statbuf.st_size / sizeof(struct sock_filter);
- bpf_prog->filter = NULL;
+ if (bpf_prog == NULL) {
+ printk(KERN_ERR "Failed to allocate bpf prog buffer");
+ return NULL;
}
+ bpf_prog->len = statbuf.st_size / sizeof(struct sock_filter);
+ bpf_prog->filter = NULL;
ffd = os_open_file(filename, of_read(OPENFLAGS()), 0);
if (ffd < 0) {
printk(KERN_ERR "Error %d opening bpf file", -errno);
--
2.17.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH] Fix null pointer dereference in vector_user_bpf
@ 2020-06-14 1:19 Gaurav Singh
2020-06-14 6:38 ` Anton Ivanov
0 siblings, 1 reply; 5+ messages in thread
From: Gaurav Singh @ 2020-06-14 1:19 UTC (permalink / raw)
To: gaurav1086, Jeff Dike, Richard Weinberger, Anton Ivanov,
Alexei Starovoitov, Daniel Borkmann, Martin KaFai Lau, Song Liu,
Yonghong Song, Andrii Nakryiko, John Fastabend, KP Singh,
Alex Dewar, Marc-André Lureau,
open list:USER-MODE LINUX (UML),
open list, open list:BPF (Safe dynamic programs and tools),
open list:BPF (Safe dynamic programs and tools)
The bpf_prog is being checked for !NULL after uml_kmalloc
but later its used directly for example:
bpf_prog->filter = bpf and is also later returned upon
success. Fix this, do a NULL check and return right away.
Signed-off-by: Gaurav Singh <gaurav1086@gmail.com>
---
arch/um/drivers/vector_user.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/arch/um/drivers/vector_user.c b/arch/um/drivers/vector_user.c
index c4a0f26b2824..0e6d6717bf73 100644
--- a/arch/um/drivers/vector_user.c
+++ b/arch/um/drivers/vector_user.c
@@ -789,10 +789,12 @@ void *uml_vector_user_bpf(char *filename)
return false;
}
bpf_prog = uml_kmalloc(sizeof(struct sock_fprog), UM_GFP_KERNEL);
- if (bpf_prog != NULL) {
- bpf_prog->len = statbuf.st_size / sizeof(struct sock_filter);
- bpf_prog->filter = NULL;
+ if (bpf_prog == NULL) {
+ printk(KERN_ERR "Failed to allocate bpf prog buffer");
+ return NULL;
}
+ bpf_prog->len = statbuf.st_size / sizeof(struct sock_filter);
+ bpf_prog->filter = NULL;
ffd = os_open_file(filename, of_read(OPENFLAGS()), 0);
if (ffd < 0) {
printk(KERN_ERR "Error %d opening bpf file", -errno);
--
2.17.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] Fix null pointer dereference in vector_user_bpf
2020-06-14 1:19 Gaurav Singh
@ 2020-06-14 6:38 ` Anton Ivanov
0 siblings, 0 replies; 5+ messages in thread
From: Anton Ivanov @ 2020-06-14 6:38 UTC (permalink / raw)
To: Gaurav Singh, Jeff Dike, Richard Weinberger, Alexei Starovoitov,
Daniel Borkmann, Martin KaFai Lau, Song Liu, Yonghong Song,
Andrii Nakryiko, John Fastabend, KP Singh, Alex Dewar,
Marc-André Lureau, open list:USER-MODE LINUX (UML),
open list, open list:BPF (Safe dynamic programs and tools),
open list:BPF (Safe dynamic programs and tools)
On 14/06/2020 02:19, Gaurav Singh wrote:
> The bpf_prog is being checked for !NULL after uml_kmalloc
> but later its used directly for example:
> bpf_prog->filter = bpf and is also later returned upon
> success. Fix this, do a NULL check and return right away.
>
> Signed-off-by: Gaurav Singh <gaurav1086@gmail.com>
> ---
> arch/um/drivers/vector_user.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/arch/um/drivers/vector_user.c b/arch/um/drivers/vector_user.c
> index c4a0f26b2824..0e6d6717bf73 100644
> --- a/arch/um/drivers/vector_user.c
> +++ b/arch/um/drivers/vector_user.c
> @@ -789,10 +789,12 @@ void *uml_vector_user_bpf(char *filename)
> return false;
> }
> bpf_prog = uml_kmalloc(sizeof(struct sock_fprog), UM_GFP_KERNEL);
> - if (bpf_prog != NULL) {
> - bpf_prog->len = statbuf.st_size / sizeof(struct sock_filter);
> - bpf_prog->filter = NULL;
> + if (bpf_prog == NULL) {
> + printk(KERN_ERR "Failed to allocate bpf prog buffer");
> + return NULL;
> }
> + bpf_prog->len = statbuf.st_size / sizeof(struct sock_filter);
> + bpf_prog->filter = NULL;
> ffd = os_open_file(filename, of_read(OPENFLAGS()), 0);
> if (ffd < 0) {
> printk(KERN_ERR "Error %d opening bpf file", -errno);
>
Acked-By: Anton Ivanov <anton.ivanov@cambridgegreys.com>
--
Anton R. Ivanov
Cambridgegreys Limited. Registered in England. Company Number 10273661
https://www.cambridgegreys.com/
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2020-06-14 7:03 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-06-10 3:43 [PATCH] Fix null pointer dereference in vector_user_bpf Gaurav Singh
2020-06-10 5:53 ` Greg KH
2020-06-11 2:40 Gaurav Singh
2020-06-14 1:19 Gaurav Singh
2020-06-14 6:38 ` Anton Ivanov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).