linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 0/2] net: cipso: bug fixes
@ 2021-07-10  7:03 Pavel Skripkin
  2021-07-10  7:03 ` [PATCH 1/2] net: cipso: fix warnings in netlbl_cipsov4_add_std Pavel Skripkin
  2021-07-10  7:03 ` [PATCH 2/2] net: cipso: fix memory leak in cipso_v4_doi_free Pavel Skripkin
  0 siblings, 2 replies; 9+ messages in thread
From: Pavel Skripkin @ 2021-07-10  7:03 UTC (permalink / raw)
  To: paul, davem, yoshfuji, dsahern, kuba
  Cc: netdev, linux-security-module, linux-kernel, Pavel Skripkin

This small patch series fixes 2 bugs in cipso code. The first one was
found by syzbot and the second was found while testing fix for the
fisrt one. All 2 bugs can be triggered by reproducer provided by syzbot:

https://syzkaller.appspot.com/bug?id=d4bc7d67efe79c6ead3cb6bd94b84dbd287f1069

Pavel Skripkin (2):
  net: cipso: fix warnings in netlbl_cipsov4_add_std
  net: cipso: fix memory leak in cipso_v4_doi_free

 net/ipv4/cipso_ipv4.c            | 1 +
 net/netlabel/netlabel_cipso_v4.c | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

-- 
2.32.0


^ permalink raw reply	[flat|nested] 9+ messages in thread

* [PATCH 1/2] net: cipso: fix warnings in netlbl_cipsov4_add_std
  2021-07-10  7:03 [PATCH 0/2] net: cipso: bug fixes Pavel Skripkin
@ 2021-07-10  7:03 ` Pavel Skripkin
  2021-07-12 15:03   ` Paul Moore
  2021-07-26 11:11   ` Pavel Skripkin
  2021-07-10  7:03 ` [PATCH 2/2] net: cipso: fix memory leak in cipso_v4_doi_free Pavel Skripkin
  1 sibling, 2 replies; 9+ messages in thread
From: Pavel Skripkin @ 2021-07-10  7:03 UTC (permalink / raw)
  To: paul, davem, yoshfuji, dsahern, kuba
  Cc: netdev, linux-security-module, linux-kernel, Pavel Skripkin,
	syzbot+cdd51ee2e6b0b2e18c0d

Syzbot reported warning in netlbl_cipsov4_add(). The
problem was in too big doi_def->map.std->lvl.local_size
passed to kcalloc(). Since this value comes from userpace there is
no need to warn if value is not correct.

The same problem may occur with other kcalloc() calls in
this function, so, I've added __GFP_NOWARN flag to all
kcalloc() calls there.

Reported-and-tested-by: syzbot+cdd51ee2e6b0b2e18c0d@syzkaller.appspotmail.com
Fixes: 96cb8e3313c7 ("[NetLabel]: CIPSOv4 and Unlabeled packet integration")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
---
 net/netlabel/netlabel_cipso_v4.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index 4f50a64315cf..50f40943c815 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -187,14 +187,14 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
 		}
 	doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size,
 					      sizeof(u32),
-					      GFP_KERNEL);
+					      GFP_KERNEL | __GFP_NOWARN);
 	if (doi_def->map.std->lvl.local == NULL) {
 		ret_val = -ENOMEM;
 		goto add_std_failure;
 	}
 	doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size,
 					      sizeof(u32),
-					      GFP_KERNEL);
+					      GFP_KERNEL | __GFP_NOWARN);
 	if (doi_def->map.std->lvl.cipso == NULL) {
 		ret_val = -ENOMEM;
 		goto add_std_failure;
@@ -263,7 +263,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
 		doi_def->map.std->cat.local = kcalloc(
 					      doi_def->map.std->cat.local_size,
 					      sizeof(u32),
-					      GFP_KERNEL);
+					      GFP_KERNEL | __GFP_NOWARN);
 		if (doi_def->map.std->cat.local == NULL) {
 			ret_val = -ENOMEM;
 			goto add_std_failure;
@@ -271,7 +271,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
 		doi_def->map.std->cat.cipso = kcalloc(
 					      doi_def->map.std->cat.cipso_size,
 					      sizeof(u32),
-					      GFP_KERNEL);
+					      GFP_KERNEL | __GFP_NOWARN);
 		if (doi_def->map.std->cat.cipso == NULL) {
 			ret_val = -ENOMEM;
 			goto add_std_failure;
-- 
2.32.0


^ permalink raw reply	[flat|nested] 9+ messages in thread

* [PATCH 2/2] net: cipso: fix memory leak in cipso_v4_doi_free
  2021-07-10  7:03 [PATCH 0/2] net: cipso: bug fixes Pavel Skripkin
  2021-07-10  7:03 ` [PATCH 1/2] net: cipso: fix warnings in netlbl_cipsov4_add_std Pavel Skripkin
@ 2021-07-10  7:03 ` Pavel Skripkin
  2021-07-10  7:29   ` Dongliang Mu
  1 sibling, 1 reply; 9+ messages in thread
From: Pavel Skripkin @ 2021-07-10  7:03 UTC (permalink / raw)
  To: paul, davem, yoshfuji, dsahern, kuba
  Cc: netdev, linux-security-module, linux-kernel, Pavel Skripkin

When doi_def->type == CIPSO_V4_MAP_TRANS doi_def->map.std should
be freed to avoid memory leak.

Fail log:

BUG: memory leak
unreferenced object 0xffff88801b936d00 (size 64):
comm "a.out", pid 8478, jiffies 4295042353 (age 15.260s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00 00 00 00 15 b8 12 26 00 00 00 00 00 00 00 00  .......&........
backtrace:
netlbl_cipsov4_add (net/netlabel/netlabel_cipso_v4.c:145 net/netlabel/netlabel_cipso_v4.c:416)
genl_family_rcv_msg_doit (net/netlink/genetlink.c:741)
genl_rcv_msg (net/netlink/genetlink.c:783 net/netlink/genetlink.c:800)
netlink_rcv_skb (net/netlink/af_netlink.c:2505)
genl_rcv (net/netlink/genetlink.c:813)

Fixes: b1edeb102397 ("netlabel: Replace protocol/NetLabel linking with refrerence
counts")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
---
 net/ipv4/cipso_ipv4.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index bfaf327e9d12..e0480c6cebaa 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -472,6 +472,7 @@ void cipso_v4_doi_free(struct cipso_v4_doi *doi_def)
 		kfree(doi_def->map.std->lvl.local);
 		kfree(doi_def->map.std->cat.cipso);
 		kfree(doi_def->map.std->cat.local);
+		kfree(doi_def->map.std);
 		break;
 	}
 	kfree(doi_def);
-- 
2.32.0


^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [PATCH 2/2] net: cipso: fix memory leak in cipso_v4_doi_free
  2021-07-10  7:03 ` [PATCH 2/2] net: cipso: fix memory leak in cipso_v4_doi_free Pavel Skripkin
@ 2021-07-10  7:29   ` Dongliang Mu
  2021-07-10  7:40     ` Pavel Skripkin
  0 siblings, 1 reply; 9+ messages in thread
From: Dongliang Mu @ 2021-07-10  7:29 UTC (permalink / raw)
  To: Pavel Skripkin
  Cc: Paul Moore, David S. Miller, yoshfuji, dsahern, Jakub Kicinski,
	open list:NETWORKING [GENERAL],
	linux-security-module, linux-kernel

On Sat, Jul 10, 2021 at 3:10 PM Pavel Skripkin <paskripkin@gmail.com> wrote:
>
> When doi_def->type == CIPSO_V4_MAP_TRANS doi_def->map.std should
> be freed to avoid memory leak.
>
> Fail log:
>
> BUG: memory leak
> unreferenced object 0xffff88801b936d00 (size 64):
> comm "a.out", pid 8478, jiffies 4295042353 (age 15.260s)
> hex dump (first 32 bytes):
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
> 00 00 00 00 15 b8 12 26 00 00 00 00 00 00 00 00  .......&........
> backtrace:
> netlbl_cipsov4_add (net/netlabel/netlabel_cipso_v4.c:145 net/netlabel/netlabel_cipso_v4.c:416)
> genl_family_rcv_msg_doit (net/netlink/genetlink.c:741)
> genl_rcv_msg (net/netlink/genetlink.c:783 net/netlink/genetlink.c:800)
> netlink_rcv_skb (net/netlink/af_netlink.c:2505)
> genl_rcv (net/netlink/genetlink.c:813)
>
> Fixes: b1edeb102397 ("netlabel: Replace protocol/NetLabel linking with refrerence
> counts")
> Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
> ---
>  net/ipv4/cipso_ipv4.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
> index bfaf327e9d12..e0480c6cebaa 100644
> --- a/net/ipv4/cipso_ipv4.c
> +++ b/net/ipv4/cipso_ipv4.c
> @@ -472,6 +472,7 @@ void cipso_v4_doi_free(struct cipso_v4_doi *doi_def)
>                 kfree(doi_def->map.std->lvl.local);
>                 kfree(doi_def->map.std->cat.cipso);
>                 kfree(doi_def->map.std->cat.local);
> +               kfree(doi_def->map.std);
>                 break;
>         }
>         kfree(doi_def);
> --

Hi Paval,

this patch is already merged by Paul. See [1] for more details.

[1] https://lore.kernel.org/netdev/CAHC9VhQZVOmy7n14nTSRGHzwN-y=E_JTUP+NpRCgD8rJN5sOGA@mail.gmail.com/T/

> 2.32.0
>

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [PATCH 2/2] net: cipso: fix memory leak in cipso_v4_doi_free
  2021-07-10  7:29   ` Dongliang Mu
@ 2021-07-10  7:40     ` Pavel Skripkin
  2021-07-10  7:42       ` Dongliang Mu
  0 siblings, 1 reply; 9+ messages in thread
From: Pavel Skripkin @ 2021-07-10  7:40 UTC (permalink / raw)
  To: Dongliang Mu
  Cc: Paul Moore, David S. Miller, yoshfuji, dsahern, Jakub Kicinski,
	open list:NETWORKING [GENERAL],
	linux-security-module, linux-kernel

On Sat, 10 Jul 2021 15:29:19 +0800
Dongliang Mu <mudongliangabcd@gmail.com> wrote:

> On Sat, Jul 10, 2021 at 3:10 PM Pavel Skripkin <paskripkin@gmail.com>
> wrote:
> >
> > When doi_def->type == CIPSO_V4_MAP_TRANS doi_def->map.std should
> > be freed to avoid memory leak.
> >
> > Fail log:
> >
> > BUG: memory leak
> > unreferenced object 0xffff88801b936d00 (size 64):
> > comm "a.out", pid 8478, jiffies 4295042353 (age 15.260s)
> > hex dump (first 32 bytes):
> > 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
> > 00 00 00 00 15 b8 12 26 00 00 00 00 00 00 00 00  .......&........
> > backtrace:
> > netlbl_cipsov4_add (net/netlabel/netlabel_cipso_v4.c:145
> > net/netlabel/netlabel_cipso_v4.c:416) genl_family_rcv_msg_doit
> > (net/netlink/genetlink.c:741) genl_rcv_msg
> > (net/netlink/genetlink.c:783 net/netlink/genetlink.c:800)
> > netlink_rcv_skb (net/netlink/af_netlink.c:2505) genl_rcv
> > (net/netlink/genetlink.c:813)
> >
> > Fixes: b1edeb102397 ("netlabel: Replace protocol/NetLabel linking
> > with refrerence counts")
> > Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
> > ---
> >  net/ipv4/cipso_ipv4.c | 1 +
> >  1 file changed, 1 insertion(+)
> >
> > diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
> > index bfaf327e9d12..e0480c6cebaa 100644
> > --- a/net/ipv4/cipso_ipv4.c
> > +++ b/net/ipv4/cipso_ipv4.c
> > @@ -472,6 +472,7 @@ void cipso_v4_doi_free(struct cipso_v4_doi
> > *doi_def) kfree(doi_def->map.std->lvl.local);
> >                 kfree(doi_def->map.std->cat.cipso);
> >                 kfree(doi_def->map.std->cat.local);
> > +               kfree(doi_def->map.std);
> >                 break;
> >         }
> >         kfree(doi_def);
> > --
> 
> Hi Paval,
> 
> this patch is already merged by Paul. See [1] for more details.
> 
> [1]
> https://lore.kernel.org/netdev/CAHC9VhQZVOmy7n14nTSRGHzwN-y=E_JTUP+NpRCgD8rJN5sOGA@mail.gmail.com/T/
> 


Hi, Dongliang!

Thank you for the information. I'm wondering, can maintainer pick only 1
patch from series, or I should send v2? 



With regards,
Pavel Skripkin

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [PATCH 2/2] net: cipso: fix memory leak in cipso_v4_doi_free
  2021-07-10  7:40     ` Pavel Skripkin
@ 2021-07-10  7:42       ` Dongliang Mu
  0 siblings, 0 replies; 9+ messages in thread
From: Dongliang Mu @ 2021-07-10  7:42 UTC (permalink / raw)
  To: Pavel Skripkin
  Cc: Paul Moore, David S. Miller, yoshfuji, dsahern, Jakub Kicinski,
	open list:NETWORKING [GENERAL],
	linux-security-module, linux-kernel

On Sat, Jul 10, 2021 at 3:41 PM Pavel Skripkin <paskripkin@gmail.com> wrote:
>
> On Sat, 10 Jul 2021 15:29:19 +0800
> Dongliang Mu <mudongliangabcd@gmail.com> wrote:
>
> > On Sat, Jul 10, 2021 at 3:10 PM Pavel Skripkin <paskripkin@gmail.com>
> > wrote:
> > >
> > > When doi_def->type == CIPSO_V4_MAP_TRANS doi_def->map.std should
> > > be freed to avoid memory leak.
> > >
> > > Fail log:
> > >
> > > BUG: memory leak
> > > unreferenced object 0xffff88801b936d00 (size 64):
> > > comm "a.out", pid 8478, jiffies 4295042353 (age 15.260s)
> > > hex dump (first 32 bytes):
> > > 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
> > > 00 00 00 00 15 b8 12 26 00 00 00 00 00 00 00 00  .......&........
> > > backtrace:
> > > netlbl_cipsov4_add (net/netlabel/netlabel_cipso_v4.c:145
> > > net/netlabel/netlabel_cipso_v4.c:416) genl_family_rcv_msg_doit
> > > (net/netlink/genetlink.c:741) genl_rcv_msg
> > > (net/netlink/genetlink.c:783 net/netlink/genetlink.c:800)
> > > netlink_rcv_skb (net/netlink/af_netlink.c:2505) genl_rcv
> > > (net/netlink/genetlink.c:813)
> > >
> > > Fixes: b1edeb102397 ("netlabel: Replace protocol/NetLabel linking
> > > with refrerence counts")
> > > Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
> > > ---
> > >  net/ipv4/cipso_ipv4.c | 1 +
> > >  1 file changed, 1 insertion(+)
> > >
> > > diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
> > > index bfaf327e9d12..e0480c6cebaa 100644
> > > --- a/net/ipv4/cipso_ipv4.c
> > > +++ b/net/ipv4/cipso_ipv4.c
> > > @@ -472,6 +472,7 @@ void cipso_v4_doi_free(struct cipso_v4_doi
> > > *doi_def) kfree(doi_def->map.std->lvl.local);
> > >                 kfree(doi_def->map.std->cat.cipso);
> > >                 kfree(doi_def->map.std->cat.local);
> > > +               kfree(doi_def->map.std);
> > >                 break;
> > >         }
> > >         kfree(doi_def);
> > > --
> >
> > Hi Paval,
> >
> > this patch is already merged by Paul. See [1] for more details.
> >
> > [1]
> > https://lore.kernel.org/netdev/CAHC9VhQZVOmy7n14nTSRGHzwN-y=E_JTUP+NpRCgD8rJN5sOGA@mail.gmail.com/T/
> >
>
>
> Hi, Dongliang!
>
> Thank you for the information. I'm wondering, can maintainer pick only 1
> patch from series, or I should send v2?

I don't know. Maybe you can wait for the reply of the maintainers.

>
>
>
> With regards,
> Pavel Skripkin

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [PATCH 1/2] net: cipso: fix warnings in netlbl_cipsov4_add_std
  2021-07-10  7:03 ` [PATCH 1/2] net: cipso: fix warnings in netlbl_cipsov4_add_std Pavel Skripkin
@ 2021-07-12 15:03   ` Paul Moore
  2021-07-26 11:11   ` Pavel Skripkin
  1 sibling, 0 replies; 9+ messages in thread
From: Paul Moore @ 2021-07-12 15:03 UTC (permalink / raw)
  To: Pavel Skripkin
  Cc: davem, yoshfuji, dsahern, kuba, netdev, linux-security-module,
	linux-kernel, syzbot+cdd51ee2e6b0b2e18c0d

On Sat, Jul 10, 2021 at 3:03 AM Pavel Skripkin <paskripkin@gmail.com> wrote:
>
> Syzbot reported warning in netlbl_cipsov4_add(). The
> problem was in too big doi_def->map.std->lvl.local_size
> passed to kcalloc(). Since this value comes from userpace there is
> no need to warn if value is not correct.
>
> The same problem may occur with other kcalloc() calls in
> this function, so, I've added __GFP_NOWARN flag to all
> kcalloc() calls there.
>
> Reported-and-tested-by: syzbot+cdd51ee2e6b0b2e18c0d@syzkaller.appspotmail.com
> Fixes: 96cb8e3313c7 ("[NetLabel]: CIPSOv4 and Unlabeled packet integration")
> Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
> ---
>  net/netlabel/netlabel_cipso_v4.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)

This seems fine to me, callers will get a ENOMEM error code too so it
isn't like the failure is going to be a mystery, especially in the
case where an obscenely large translation mapping is being attempted.

Acked-by: Paul Moore <paul@paul-moore.com>

As an aside, I see no reason why this patch can't be merged and 2/2
simply dropped as already in-tree.  As has already been pointed out,
patch 2/2 is a duplicate; the in-tree commit is d612c3f3fae2 ("net:
ipv4: fix memory leak in netlbl_cipsov4_add_std").

> diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
> index 4f50a64315cf..50f40943c815 100644
> --- a/net/netlabel/netlabel_cipso_v4.c
> +++ b/net/netlabel/netlabel_cipso_v4.c
> @@ -187,14 +187,14 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
>                 }
>         doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size,
>                                               sizeof(u32),
> -                                             GFP_KERNEL);
> +                                             GFP_KERNEL | __GFP_NOWARN);
>         if (doi_def->map.std->lvl.local == NULL) {
>                 ret_val = -ENOMEM;
>                 goto add_std_failure;
>         }
>         doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size,
>                                               sizeof(u32),
> -                                             GFP_KERNEL);
> +                                             GFP_KERNEL | __GFP_NOWARN);
>         if (doi_def->map.std->lvl.cipso == NULL) {
>                 ret_val = -ENOMEM;
>                 goto add_std_failure;
> @@ -263,7 +263,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
>                 doi_def->map.std->cat.local = kcalloc(
>                                               doi_def->map.std->cat.local_size,
>                                               sizeof(u32),
> -                                             GFP_KERNEL);
> +                                             GFP_KERNEL | __GFP_NOWARN);
>                 if (doi_def->map.std->cat.local == NULL) {
>                         ret_val = -ENOMEM;
>                         goto add_std_failure;
> @@ -271,7 +271,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
>                 doi_def->map.std->cat.cipso = kcalloc(
>                                               doi_def->map.std->cat.cipso_size,
>                                               sizeof(u32),
> -                                             GFP_KERNEL);
> +                                             GFP_KERNEL | __GFP_NOWARN);
>                 if (doi_def->map.std->cat.cipso == NULL) {
>                         ret_val = -ENOMEM;
>                         goto add_std_failure;
> --
> 2.32.0

-- 
paul moore
www.paul-moore.com

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [PATCH 1/2] net: cipso: fix warnings in netlbl_cipsov4_add_std
  2021-07-10  7:03 ` [PATCH 1/2] net: cipso: fix warnings in netlbl_cipsov4_add_std Pavel Skripkin
  2021-07-12 15:03   ` Paul Moore
@ 2021-07-26 11:11   ` Pavel Skripkin
  2021-07-27  2:40     ` Paul Moore
  1 sibling, 1 reply; 9+ messages in thread
From: Pavel Skripkin @ 2021-07-26 11:11 UTC (permalink / raw)
  To: paul, davem, yoshfuji, dsahern, kuba
  Cc: netdev, linux-security-module, linux-kernel, syzbot+cdd51ee2e6b0b2e18c0d

On Sat, 10 Jul 2021 10:03:13 +0300
Pavel Skripkin <paskripkin@gmail.com> wrote:

> Syzbot reported warning in netlbl_cipsov4_add(). The
> problem was in too big doi_def->map.std->lvl.local_size
> passed to kcalloc(). Since this value comes from userpace there is
> no need to warn if value is not correct.
> 
> The same problem may occur with other kcalloc() calls in
> this function, so, I've added __GFP_NOWARN flag to all
> kcalloc() calls there.
> 
> Reported-and-tested-by:
> syzbot+cdd51ee2e6b0b2e18c0d@syzkaller.appspotmail.com Fixes:
> 96cb8e3313c7 ("[NetLabel]: CIPSOv4 and Unlabeled packet integration")
> Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> ---
>  net/netlabel/netlabel_cipso_v4.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/net/netlabel/netlabel_cipso_v4.c
> b/net/netlabel/netlabel_cipso_v4.c index 4f50a64315cf..50f40943c815
> 100644 --- a/net/netlabel/netlabel_cipso_v4.c
> +++ b/net/netlabel/netlabel_cipso_v4.c
> @@ -187,14 +187,14 @@ static int netlbl_cipsov4_add_std(struct
> genl_info *info, }
>  	doi_def->map.std->lvl.local =
> kcalloc(doi_def->map.std->lvl.local_size, sizeof(u32),
> -					      GFP_KERNEL);
> +					      GFP_KERNEL |
> __GFP_NOWARN); if (doi_def->map.std->lvl.local == NULL) {
>  		ret_val = -ENOMEM;
>  		goto add_std_failure;
>  	}
>  	doi_def->map.std->lvl.cipso =
> kcalloc(doi_def->map.std->lvl.cipso_size, sizeof(u32),
> -					      GFP_KERNEL);
> +					      GFP_KERNEL |
> __GFP_NOWARN); if (doi_def->map.std->lvl.cipso == NULL) {
>  		ret_val = -ENOMEM;
>  		goto add_std_failure;
> @@ -263,7 +263,7 @@ static int netlbl_cipsov4_add_std(struct
> genl_info *info, doi_def->map.std->cat.local = kcalloc(
>  					      doi_def->map.std->cat.local_size,
>  					      sizeof(u32),
> -					      GFP_KERNEL);
> +					      GFP_KERNEL |
> __GFP_NOWARN); if (doi_def->map.std->cat.local == NULL) {
>  			ret_val = -ENOMEM;
>  			goto add_std_failure;
> @@ -271,7 +271,7 @@ static int netlbl_cipsov4_add_std(struct
> genl_info *info, doi_def->map.std->cat.cipso = kcalloc(
>  					      doi_def->map.std->cat.cipso_size,
>  					      sizeof(u32),
> -					      GFP_KERNEL);
> +					      GFP_KERNEL |
> __GFP_NOWARN); if (doi_def->map.std->cat.cipso == NULL) {
>  			ret_val = -ENOMEM;
>  			goto add_std_failure;


Hi, net developers!

Is this patch merged somewhere? I've checked net tree and Paul Moore
tree on https://git.kernel.org/, but didn't find it. Did I miss it
somewhere? If not, it's just a gentle ping :)

Btw: maybe I should send it as separete patch, since 2/2 in this
series is invalid as already in-tree?


 
With regards,
Pavel Skripkin


^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [PATCH 1/2] net: cipso: fix warnings in netlbl_cipsov4_add_std
  2021-07-26 11:11   ` Pavel Skripkin
@ 2021-07-27  2:40     ` Paul Moore
  0 siblings, 0 replies; 9+ messages in thread
From: Paul Moore @ 2021-07-27  2:40 UTC (permalink / raw)
  To: Pavel Skripkin
  Cc: davem, yoshfuji, dsahern, kuba, netdev, linux-security-module,
	linux-kernel, syzbot+cdd51ee2e6b0b2e18c0d

On Mon, Jul 26, 2021 at 7:11 AM Pavel Skripkin <paskripkin@gmail.com> wrote:
> On Sat, 10 Jul 2021 10:03:13 +0300
> Pavel Skripkin <paskripkin@gmail.com> wrote:
>
> > Syzbot reported warning in netlbl_cipsov4_add(). The
> > problem was in too big doi_def->map.std->lvl.local_size
> > passed to kcalloc(). Since this value comes from userpace there is
> > no need to warn if value is not correct.
> >
> > The same problem may occur with other kcalloc() calls in
> > this function, so, I've added __GFP_NOWARN flag to all
> > kcalloc() calls there.
> >
> > Reported-and-tested-by:
> > syzbot+cdd51ee2e6b0b2e18c0d@syzkaller.appspotmail.com Fixes:
> > 96cb8e3313c7 ("[NetLabel]: CIPSOv4 and Unlabeled packet integration")
> > Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> ---
> >  net/netlabel/netlabel_cipso_v4.c | 8 ++++----
> >  1 file changed, 4 insertions(+), 4 deletions(-)
>
> Hi, net developers!
>
> Is this patch merged somewhere? I've checked net tree and Paul Moore
> tree on https://git.kernel.org/, but didn't find it. Did I miss it
> somewhere? If not, it's just a gentle ping :)
>
> Btw: maybe I should send it as separete patch, since 2/2 in this
> series is invalid as already in-tree?

I'm not sure why this hasn't been picked up yet, but I suppose
resubmitting just this patch couldn't hurt.  Don't forget to include
my ACK if you do.

-- 
paul moore
www.paul-moore.com

^ permalink raw reply	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2021-07-27  2:40 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-10  7:03 [PATCH 0/2] net: cipso: bug fixes Pavel Skripkin
2021-07-10  7:03 ` [PATCH 1/2] net: cipso: fix warnings in netlbl_cipsov4_add_std Pavel Skripkin
2021-07-12 15:03   ` Paul Moore
2021-07-26 11:11   ` Pavel Skripkin
2021-07-27  2:40     ` Paul Moore
2021-07-10  7:03 ` [PATCH 2/2] net: cipso: fix memory leak in cipso_v4_doi_free Pavel Skripkin
2021-07-10  7:29   ` Dongliang Mu
2021-07-10  7:40     ` Pavel Skripkin
2021-07-10  7:42       ` Dongliang Mu

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).