* [PATCH AUTOSEL 5.13 13/14] net: fix NULL pointer reference in cipso_v4_doi_free
[not found] <20210830115942.1017300-1-sashal@kernel.org>
@ 2021-08-30 11:59 ` Sasha Levin
2021-08-30 12:42 ` Dongliang Mu
0 siblings, 1 reply; 5+ messages in thread
From: Sasha Levin @ 2021-08-30 11:59 UTC (permalink / raw)
To: linux-kernel, stable
Cc: 王贇, Abaci, David S . Miller, Sasha Levin, netdev,
linux-security-module
From: 王贇 <yun.wang@linux.alibaba.com>
[ Upstream commit 733c99ee8be9a1410287cdbb943887365e83b2d6 ]
In netlbl_cipsov4_add_std() when 'doi_def->map.std' alloc
failed, we sometime observe panic:
BUG: kernel NULL pointer dereference, address:
...
RIP: 0010:cipso_v4_doi_free+0x3a/0x80
...
Call Trace:
netlbl_cipsov4_add_std+0xf4/0x8c0
netlbl_cipsov4_add+0x13f/0x1b0
genl_family_rcv_msg_doit.isra.15+0x132/0x170
genl_rcv_msg+0x125/0x240
This is because in cipso_v4_doi_free() there is no check
on 'doi_def->map.std' when 'doi_def->type' equal 1, which
is possibe, since netlbl_cipsov4_add_std() haven't initialize
it before alloc 'doi_def->map.std'.
This patch just add the check to prevent panic happen for similar
cases.
Reported-by: Abaci <abaci@linux.alibaba.com>
Signed-off-by: Michael Wang <yun.wang@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/cipso_ipv4.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index e0480c6cebaa..16bbd62db791 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -466,14 +466,16 @@ void cipso_v4_doi_free(struct cipso_v4_doi *doi_def)
if (!doi_def)
return;
- switch (doi_def->type) {
- case CIPSO_V4_MAP_TRANS:
- kfree(doi_def->map.std->lvl.cipso);
- kfree(doi_def->map.std->lvl.local);
- kfree(doi_def->map.std->cat.cipso);
- kfree(doi_def->map.std->cat.local);
- kfree(doi_def->map.std);
- break;
+ if (doi_def->map.std) {
+ switch (doi_def->type) {
+ case CIPSO_V4_MAP_TRANS:
+ kfree(doi_def->map.std->lvl.cipso);
+ kfree(doi_def->map.std->lvl.local);
+ kfree(doi_def->map.std->cat.cipso);
+ kfree(doi_def->map.std->cat.local);
+ kfree(doi_def->map.std);
+ break;
+ }
}
kfree(doi_def);
}
--
2.30.2
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH AUTOSEL 5.13 13/14] net: fix NULL pointer reference in cipso_v4_doi_free
2021-08-30 11:59 ` [PATCH AUTOSEL 5.13 13/14] net: fix NULL pointer reference in cipso_v4_doi_free Sasha Levin
@ 2021-08-30 12:42 ` Dongliang Mu
2021-08-30 14:20 ` Paul Moore
0 siblings, 1 reply; 5+ messages in thread
From: Dongliang Mu @ 2021-08-30 12:42 UTC (permalink / raw)
To: Sasha Levin
Cc: linux-kernel, stable, 王贇, Abaci, David S . Miller,
open list:NETWORKING [GENERAL], linux-security-module
On Mon, Aug 30, 2021 at 8:01 PM Sasha Levin <sashal@kernel.org> wrote:
>
> From: 王贇 <yun.wang@linux.alibaba.com>
>
> [ Upstream commit 733c99ee8be9a1410287cdbb943887365e83b2d6 ]
>
Hi Sasha,
Michael Wang has sent a v2 patch [1] for this bug and it is merged
into netdev/net-next.git. However, the v1 patch is already in the
upstream tree.
How do you guys handle such a issue?
[1] https://lkml.org/lkml/2021/8/30/229
> In netlbl_cipsov4_add_std() when 'doi_def->map.std' alloc
> failed, we sometime observe panic:
>
> BUG: kernel NULL pointer dereference, address:
> ...
> RIP: 0010:cipso_v4_doi_free+0x3a/0x80
> ...
> Call Trace:
> netlbl_cipsov4_add_std+0xf4/0x8c0
> netlbl_cipsov4_add+0x13f/0x1b0
> genl_family_rcv_msg_doit.isra.15+0x132/0x170
> genl_rcv_msg+0x125/0x240
>
> This is because in cipso_v4_doi_free() there is no check
> on 'doi_def->map.std' when 'doi_def->type' equal 1, which
> is possibe, since netlbl_cipsov4_add_std() haven't initialize
> it before alloc 'doi_def->map.std'.
>
> This patch just add the check to prevent panic happen for similar
> cases.
>
> Reported-by: Abaci <abaci@linux.alibaba.com>
> Signed-off-by: Michael Wang <yun.wang@linux.alibaba.com>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> net/ipv4/cipso_ipv4.c | 18 ++++++++++--------
> 1 file changed, 10 insertions(+), 8 deletions(-)
>
> diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
> index e0480c6cebaa..16bbd62db791 100644
> --- a/net/ipv4/cipso_ipv4.c
> +++ b/net/ipv4/cipso_ipv4.c
> @@ -466,14 +466,16 @@ void cipso_v4_doi_free(struct cipso_v4_doi *doi_def)
> if (!doi_def)
> return;
>
> - switch (doi_def->type) {
> - case CIPSO_V4_MAP_TRANS:
> - kfree(doi_def->map.std->lvl.cipso);
> - kfree(doi_def->map.std->lvl.local);
> - kfree(doi_def->map.std->cat.cipso);
> - kfree(doi_def->map.std->cat.local);
> - kfree(doi_def->map.std);
> - break;
> + if (doi_def->map.std) {
> + switch (doi_def->type) {
> + case CIPSO_V4_MAP_TRANS:
> + kfree(doi_def->map.std->lvl.cipso);
> + kfree(doi_def->map.std->lvl.local);
> + kfree(doi_def->map.std->cat.cipso);
> + kfree(doi_def->map.std->cat.local);
> + kfree(doi_def->map.std);
> + break;
> + }
> }
> kfree(doi_def);
> }
> --
> 2.30.2
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH AUTOSEL 5.13 13/14] net: fix NULL pointer reference in cipso_v4_doi_free
2021-08-30 12:42 ` Dongliang Mu
@ 2021-08-30 14:20 ` Paul Moore
2021-09-05 12:54 ` Sasha Levin
0 siblings, 1 reply; 5+ messages in thread
From: Paul Moore @ 2021-08-30 14:20 UTC (permalink / raw)
To: Dongliang Mu, 王贇
Cc: Sasha Levin, linux-kernel, stable, Abaci, David S . Miller,
open list:NETWORKING [GENERAL], linux-security-module
On Mon, Aug 30, 2021 at 8:42 AM Dongliang Mu <mudongliangabcd@gmail.com> wrote:
>
> On Mon, Aug 30, 2021 at 8:01 PM Sasha Levin <sashal@kernel.org> wrote:
> >
> > From: 王贇 <yun.wang@linux.alibaba.com>
> >
> > [ Upstream commit 733c99ee8be9a1410287cdbb943887365e83b2d6 ]
> >
>
> Hi Sasha,
>
> Michael Wang has sent a v2 patch [1] for this bug and it is merged
> into netdev/net-next.git. However, the v1 patch is already in the
> upstream tree.
>
> How do you guys handle such a issue?
>
> [1] https://lkml.org/lkml/2021/8/30/229
Ugh. Michael can you please work with netdev to fix this in the
upstream, and hopefully -stable, kernels? My guess is you will need
to rebase your v2 patch on top of the v1 patch (basically what exists
in upstream) and send that back out.
--
paul moore
www.paul-moore.com
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH AUTOSEL 5.13 13/14] net: fix NULL pointer reference in cipso_v4_doi_free
2021-08-30 14:20 ` Paul Moore
@ 2021-09-05 12:54 ` Sasha Levin
2021-09-07 13:06 ` Paul Moore
0 siblings, 1 reply; 5+ messages in thread
From: Sasha Levin @ 2021-09-05 12:54 UTC (permalink / raw)
To: Paul Moore
Cc: Dongliang Mu, 王贇, linux-kernel, stable, Abaci,
David S . Miller, open list:NETWORKING [GENERAL],
linux-security-module
On Mon, Aug 30, 2021 at 10:20:22AM -0400, Paul Moore wrote:
>On Mon, Aug 30, 2021 at 8:42 AM Dongliang Mu <mudongliangabcd@gmail.com> wrote:
>>
>> On Mon, Aug 30, 2021 at 8:01 PM Sasha Levin <sashal@kernel.org> wrote:
>> >
>> > From: 王贇 <yun.wang@linux.alibaba.com>
>> >
>> > [ Upstream commit 733c99ee8be9a1410287cdbb943887365e83b2d6 ]
>> >
>>
>> Hi Sasha,
>>
>> Michael Wang has sent a v2 patch [1] for this bug and it is merged
>> into netdev/net-next.git. However, the v1 patch is already in the
>> upstream tree.
>>
>> How do you guys handle such a issue?
>>
>> [1] https://lkml.org/lkml/2021/8/30/229
>
>Ugh. Michael can you please work with netdev to fix this in the
>upstream, and hopefully -stable, kernels? My guess is you will need
>to rebase your v2 patch on top of the v1 patch (basically what exists
>in upstream) and send that back out.
I'm just going to drop this one for now (it never made it in). If there
is a follow-up you do want us to queue please let us know :)
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH AUTOSEL 5.13 13/14] net: fix NULL pointer reference in cipso_v4_doi_free
2021-09-05 12:54 ` Sasha Levin
@ 2021-09-07 13:06 ` Paul Moore
0 siblings, 0 replies; 5+ messages in thread
From: Paul Moore @ 2021-09-07 13:06 UTC (permalink / raw)
To: Sasha Levin
Cc: Dongliang Mu, 王贇, linux-kernel, stable, Abaci,
David S . Miller, open list:NETWORKING [GENERAL],
linux-security-module
On Sun, Sep 5, 2021 at 8:54 AM Sasha Levin <sashal@kernel.org> wrote:
> On Mon, Aug 30, 2021 at 10:20:22AM -0400, Paul Moore wrote:
> >On Mon, Aug 30, 2021 at 8:42 AM Dongliang Mu <mudongliangabcd@gmail.com> wrote:
> >>
> >> On Mon, Aug 30, 2021 at 8:01 PM Sasha Levin <sashal@kernel.org> wrote:
> >> >
> >> > From: 王贇 <yun.wang@linux.alibaba.com>
> >> >
> >> > [ Upstream commit 733c99ee8be9a1410287cdbb943887365e83b2d6 ]
> >> >
> >>
> >> Hi Sasha,
> >>
> >> Michael Wang has sent a v2 patch [1] for this bug and it is merged
> >> into netdev/net-next.git. However, the v1 patch is already in the
> >> upstream tree.
> >>
> >> How do you guys handle such a issue?
> >>
> >> [1] https://lkml.org/lkml/2021/8/30/229
> >
> >Ugh. Michael can you please work with netdev to fix this in the
> >upstream, and hopefully -stable, kernels? My guess is you will need
> >to rebase your v2 patch on top of the v1 patch (basically what exists
> >in upstream) and send that back out.
>
> I'm just going to drop this one for now (it never made it in). If there
> is a follow-up you do want us to queue please let us know :)
Thanks Sasha. The lore link below is the v2 version of the patch and
it is worth merging as a fix into the older kernels.
* https://lore.kernel.org/linux-security-module/18f0171e-0cc8-6ae6-d04a-a69a2a3c1a39@linux.alibaba.com
--
paul moore
www.paul-moore.com
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-09-07 13:07 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20210830115942.1017300-1-sashal@kernel.org>
2021-08-30 11:59 ` [PATCH AUTOSEL 5.13 13/14] net: fix NULL pointer reference in cipso_v4_doi_free Sasha Levin
2021-08-30 12:42 ` Dongliang Mu
2021-08-30 14:20 ` Paul Moore
2021-09-05 12:54 ` Sasha Levin
2021-09-07 13:06 ` Paul Moore
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).