* [PATCH net] ipv6: route: Fix return value of ip6_neigh_lookup() on neigh_create() error
@ 2019-01-02 12:29 Stefano Brivio
2019-01-02 15:59 ` David Ahern
2019-01-02 18:30 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Stefano Brivio @ 2019-01-02 12:29 UTC (permalink / raw)
To: David S. Miller; +Cc: Jianlin Shi, David Ahern, netdev
In ip6_neigh_lookup(), we must not return errors coming from
neigh_create(): if creation of a neighbour entry fails, the lookup should
return NULL, in the same way as it's done in __neigh_lookup().
Otherwise, callers legitimately checking for a non-NULL return value of
the lookup function might dereference an invalid pointer.
For instance, on neighbour table overflow, ndisc_router_discovery()
crashes ndisc_update() by passing ERR_PTR(-ENOBUFS) as 'neigh' argument.
Reported-by: Jianlin Shi <jishi@redhat.com>
Fixes: f8a1b43b709d ("net/ipv6: Create a neigh_lookup for FIB entries")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
---
net/ipv6/route.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index a94e0b02a8ac..40b225f87d5e 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -210,7 +210,9 @@ struct neighbour *ip6_neigh_lookup(const struct in6_addr *gw,
n = __ipv6_neigh_lookup(dev, daddr);
if (n)
return n;
- return neigh_create(&nd_tbl, daddr, dev);
+
+ n = neigh_create(&nd_tbl, daddr, dev);
+ return IS_ERR(n) ? NULL : n;
}
static struct neighbour *ip6_dst_neigh_lookup(const struct dst_entry *dst,
--
2.19.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net] ipv6: route: Fix return value of ip6_neigh_lookup() on neigh_create() error
2019-01-02 12:29 [PATCH net] ipv6: route: Fix return value of ip6_neigh_lookup() on neigh_create() error Stefano Brivio
@ 2019-01-02 15:59 ` David Ahern
2019-01-02 18:30 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Ahern @ 2019-01-02 15:59 UTC (permalink / raw)
To: Stefano Brivio, David S. Miller; +Cc: Jianlin Shi, netdev
On 1/2/19 5:29 AM, Stefano Brivio wrote:
> In ip6_neigh_lookup(), we must not return errors coming from
> neigh_create(): if creation of a neighbour entry fails, the lookup should
> return NULL, in the same way as it's done in __neigh_lookup().
>
> Otherwise, callers legitimately checking for a non-NULL return value of
> the lookup function might dereference an invalid pointer.
>
> For instance, on neighbour table overflow, ndisc_router_discovery()
> crashes ndisc_update() by passing ERR_PTR(-ENOBUFS) as 'neigh' argument.
>
> Reported-by: Jianlin Shi <jishi@redhat.com>
> Fixes: f8a1b43b709d ("net/ipv6: Create a neigh_lookup for FIB entries")
> Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
> ---
> net/ipv6/route.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index a94e0b02a8ac..40b225f87d5e 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -210,7 +210,9 @@ struct neighbour *ip6_neigh_lookup(const struct in6_addr *gw,
> n = __ipv6_neigh_lookup(dev, daddr);
> if (n)
> return n;
> - return neigh_create(&nd_tbl, daddr, dev);
> +
> + n = neigh_create(&nd_tbl, daddr, dev);
> + return IS_ERR(n) ? NULL : n;
> }
>
> static struct neighbour *ip6_dst_neigh_lookup(const struct dst_entry *dst,
>
I see now -- dst_neigh_lookup handles that check and I forgot to add the
same to the new ip6_neigh_lookup.
Thanks for the patch.
Reviewed-by: David Ahern <dsahern@gmail.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net] ipv6: route: Fix return value of ip6_neigh_lookup() on neigh_create() error
2019-01-02 12:29 [PATCH net] ipv6: route: Fix return value of ip6_neigh_lookup() on neigh_create() error Stefano Brivio
2019-01-02 15:59 ` David Ahern
@ 2019-01-02 18:30 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2019-01-02 18:30 UTC (permalink / raw)
To: sbrivio; +Cc: jishi, dsahern, netdev
From: Stefano Brivio <sbrivio@redhat.com>
Date: Wed, 2 Jan 2019 13:29:27 +0100
> In ip6_neigh_lookup(), we must not return errors coming from
> neigh_create(): if creation of a neighbour entry fails, the lookup should
> return NULL, in the same way as it's done in __neigh_lookup().
>
> Otherwise, callers legitimately checking for a non-NULL return value of
> the lookup function might dereference an invalid pointer.
>
> For instance, on neighbour table overflow, ndisc_router_discovery()
> crashes ndisc_update() by passing ERR_PTR(-ENOBUFS) as 'neigh' argument.
>
> Reported-by: Jianlin Shi <jishi@redhat.com>
> Fixes: f8a1b43b709d ("net/ipv6: Create a neigh_lookup for FIB entries")
> Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Applied and queued up for -stable, thank you.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-01-02 18:30 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-01-02 12:29 [PATCH net] ipv6: route: Fix return value of ip6_neigh_lookup() on neigh_create() error Stefano Brivio
2019-01-02 15:59 ` David Ahern
2019-01-02 18:30 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).