* [PATCH AUTOSEL 5.13 13/14] net: fix NULL pointer reference in cipso_v4_doi_free [not found] <20210830115942.1017300-1-sashal@kernel.org> @ 2021-08-30 11:59 ` Sasha Levin 2021-08-30 12:42 ` Dongliang Mu 0 siblings, 1 reply; 5+ messages in thread From: Sasha Levin @ 2021-08-30 11:59 UTC (permalink / raw) To: linux-kernel, stable Cc: 王贇, Abaci, David S . Miller, Sasha Levin, netdev, linux-security-module From: 王贇 <yun.wang@linux.alibaba.com> [ Upstream commit 733c99ee8be9a1410287cdbb943887365e83b2d6 ] In netlbl_cipsov4_add_std() when 'doi_def->map.std' alloc failed, we sometime observe panic: BUG: kernel NULL pointer dereference, address: ... RIP: 0010:cipso_v4_doi_free+0x3a/0x80 ... Call Trace: netlbl_cipsov4_add_std+0xf4/0x8c0 netlbl_cipsov4_add+0x13f/0x1b0 genl_family_rcv_msg_doit.isra.15+0x132/0x170 genl_rcv_msg+0x125/0x240 This is because in cipso_v4_doi_free() there is no check on 'doi_def->map.std' when 'doi_def->type' equal 1, which is possibe, since netlbl_cipsov4_add_std() haven't initialize it before alloc 'doi_def->map.std'. This patch just add the check to prevent panic happen for similar cases. Reported-by: Abaci <abaci@linux.alibaba.com> Signed-off-by: Michael Wang <yun.wang@linux.alibaba.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org> --- net/ipv4/cipso_ipv4.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c index e0480c6cebaa..16bbd62db791 100644 --- a/net/ipv4/cipso_ipv4.c +++ b/net/ipv4/cipso_ipv4.c @@ -466,14 +466,16 @@ void cipso_v4_doi_free(struct cipso_v4_doi *doi_def) if (!doi_def) return; - switch (doi_def->type) { - case CIPSO_V4_MAP_TRANS: - kfree(doi_def->map.std->lvl.cipso); - kfree(doi_def->map.std->lvl.local); - kfree(doi_def->map.std->cat.cipso); - kfree(doi_def->map.std->cat.local); - kfree(doi_def->map.std); - break; + if (doi_def->map.std) { + switch (doi_def->type) { + case CIPSO_V4_MAP_TRANS: + kfree(doi_def->map.std->lvl.cipso); + kfree(doi_def->map.std->lvl.local); + kfree(doi_def->map.std->cat.cipso); + kfree(doi_def->map.std->cat.local); + kfree(doi_def->map.std); + break; + } } kfree(doi_def); } -- 2.30.2 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH AUTOSEL 5.13 13/14] net: fix NULL pointer reference in cipso_v4_doi_free 2021-08-30 11:59 ` [PATCH AUTOSEL 5.13 13/14] net: fix NULL pointer reference in cipso_v4_doi_free Sasha Levin @ 2021-08-30 12:42 ` Dongliang Mu 2021-08-30 14:20 ` Paul Moore 0 siblings, 1 reply; 5+ messages in thread From: Dongliang Mu @ 2021-08-30 12:42 UTC (permalink / raw) To: Sasha Levin Cc: linux-kernel, stable, 王贇, Abaci, David S . Miller, open list:NETWORKING [GENERAL], linux-security-module On Mon, Aug 30, 2021 at 8:01 PM Sasha Levin <sashal@kernel.org> wrote: > > From: 王贇 <yun.wang@linux.alibaba.com> > > [ Upstream commit 733c99ee8be9a1410287cdbb943887365e83b2d6 ] > Hi Sasha, Michael Wang has sent a v2 patch [1] for this bug and it is merged into netdev/net-next.git. However, the v1 patch is already in the upstream tree. How do you guys handle such a issue? [1] https://lkml.org/lkml/2021/8/30/229 > In netlbl_cipsov4_add_std() when 'doi_def->map.std' alloc > failed, we sometime observe panic: > > BUG: kernel NULL pointer dereference, address: > ... > RIP: 0010:cipso_v4_doi_free+0x3a/0x80 > ... > Call Trace: > netlbl_cipsov4_add_std+0xf4/0x8c0 > netlbl_cipsov4_add+0x13f/0x1b0 > genl_family_rcv_msg_doit.isra.15+0x132/0x170 > genl_rcv_msg+0x125/0x240 > > This is because in cipso_v4_doi_free() there is no check > on 'doi_def->map.std' when 'doi_def->type' equal 1, which > is possibe, since netlbl_cipsov4_add_std() haven't initialize > it before alloc 'doi_def->map.std'. > > This patch just add the check to prevent panic happen for similar > cases. > > Reported-by: Abaci <abaci@linux.alibaba.com> > Signed-off-by: Michael Wang <yun.wang@linux.alibaba.com> > Signed-off-by: David S. Miller <davem@davemloft.net> > Signed-off-by: Sasha Levin <sashal@kernel.org> > --- > net/ipv4/cipso_ipv4.c | 18 ++++++++++-------- > 1 file changed, 10 insertions(+), 8 deletions(-) > > diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c > index e0480c6cebaa..16bbd62db791 100644 > --- a/net/ipv4/cipso_ipv4.c > +++ b/net/ipv4/cipso_ipv4.c > @@ -466,14 +466,16 @@ void cipso_v4_doi_free(struct cipso_v4_doi *doi_def) > if (!doi_def) > return; > > - switch (doi_def->type) { > - case CIPSO_V4_MAP_TRANS: > - kfree(doi_def->map.std->lvl.cipso); > - kfree(doi_def->map.std->lvl.local); > - kfree(doi_def->map.std->cat.cipso); > - kfree(doi_def->map.std->cat.local); > - kfree(doi_def->map.std); > - break; > + if (doi_def->map.std) { > + switch (doi_def->type) { > + case CIPSO_V4_MAP_TRANS: > + kfree(doi_def->map.std->lvl.cipso); > + kfree(doi_def->map.std->lvl.local); > + kfree(doi_def->map.std->cat.cipso); > + kfree(doi_def->map.std->cat.local); > + kfree(doi_def->map.std); > + break; > + } > } > kfree(doi_def); > } > -- > 2.30.2 > ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH AUTOSEL 5.13 13/14] net: fix NULL pointer reference in cipso_v4_doi_free 2021-08-30 12:42 ` Dongliang Mu @ 2021-08-30 14:20 ` Paul Moore 2021-09-05 12:54 ` Sasha Levin 0 siblings, 1 reply; 5+ messages in thread From: Paul Moore @ 2021-08-30 14:20 UTC (permalink / raw) To: Dongliang Mu, 王贇 Cc: Sasha Levin, linux-kernel, stable, Abaci, David S . Miller, open list:NETWORKING [GENERAL], linux-security-module On Mon, Aug 30, 2021 at 8:42 AM Dongliang Mu <mudongliangabcd@gmail.com> wrote: > > On Mon, Aug 30, 2021 at 8:01 PM Sasha Levin <sashal@kernel.org> wrote: > > > > From: 王贇 <yun.wang@linux.alibaba.com> > > > > [ Upstream commit 733c99ee8be9a1410287cdbb943887365e83b2d6 ] > > > > Hi Sasha, > > Michael Wang has sent a v2 patch [1] for this bug and it is merged > into netdev/net-next.git. However, the v1 patch is already in the > upstream tree. > > How do you guys handle such a issue? > > [1] https://lkml.org/lkml/2021/8/30/229 Ugh. Michael can you please work with netdev to fix this in the upstream, and hopefully -stable, kernels? My guess is you will need to rebase your v2 patch on top of the v1 patch (basically what exists in upstream) and send that back out. -- paul moore www.paul-moore.com ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH AUTOSEL 5.13 13/14] net: fix NULL pointer reference in cipso_v4_doi_free 2021-08-30 14:20 ` Paul Moore @ 2021-09-05 12:54 ` Sasha Levin 2021-09-07 13:06 ` Paul Moore 0 siblings, 1 reply; 5+ messages in thread From: Sasha Levin @ 2021-09-05 12:54 UTC (permalink / raw) To: Paul Moore Cc: Dongliang Mu, 王贇, linux-kernel, stable, Abaci, David S . Miller, open list:NETWORKING [GENERAL], linux-security-module On Mon, Aug 30, 2021 at 10:20:22AM -0400, Paul Moore wrote: >On Mon, Aug 30, 2021 at 8:42 AM Dongliang Mu <mudongliangabcd@gmail.com> wrote: >> >> On Mon, Aug 30, 2021 at 8:01 PM Sasha Levin <sashal@kernel.org> wrote: >> > >> > From: 王贇 <yun.wang@linux.alibaba.com> >> > >> > [ Upstream commit 733c99ee8be9a1410287cdbb943887365e83b2d6 ] >> > >> >> Hi Sasha, >> >> Michael Wang has sent a v2 patch [1] for this bug and it is merged >> into netdev/net-next.git. However, the v1 patch is already in the >> upstream tree. >> >> How do you guys handle such a issue? >> >> [1] https://lkml.org/lkml/2021/8/30/229 > >Ugh. Michael can you please work with netdev to fix this in the >upstream, and hopefully -stable, kernels? My guess is you will need >to rebase your v2 patch on top of the v1 patch (basically what exists >in upstream) and send that back out. I'm just going to drop this one for now (it never made it in). If there is a follow-up you do want us to queue please let us know :) -- Thanks, Sasha ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH AUTOSEL 5.13 13/14] net: fix NULL pointer reference in cipso_v4_doi_free 2021-09-05 12:54 ` Sasha Levin @ 2021-09-07 13:06 ` Paul Moore 0 siblings, 0 replies; 5+ messages in thread From: Paul Moore @ 2021-09-07 13:06 UTC (permalink / raw) To: Sasha Levin Cc: Dongliang Mu, 王贇, linux-kernel, stable, Abaci, David S . Miller, open list:NETWORKING [GENERAL], linux-security-module On Sun, Sep 5, 2021 at 8:54 AM Sasha Levin <sashal@kernel.org> wrote: > On Mon, Aug 30, 2021 at 10:20:22AM -0400, Paul Moore wrote: > >On Mon, Aug 30, 2021 at 8:42 AM Dongliang Mu <mudongliangabcd@gmail.com> wrote: > >> > >> On Mon, Aug 30, 2021 at 8:01 PM Sasha Levin <sashal@kernel.org> wrote: > >> > > >> > From: 王贇 <yun.wang@linux.alibaba.com> > >> > > >> > [ Upstream commit 733c99ee8be9a1410287cdbb943887365e83b2d6 ] > >> > > >> > >> Hi Sasha, > >> > >> Michael Wang has sent a v2 patch [1] for this bug and it is merged > >> into netdev/net-next.git. However, the v1 patch is already in the > >> upstream tree. > >> > >> How do you guys handle such a issue? > >> > >> [1] https://lkml.org/lkml/2021/8/30/229 > > > >Ugh. Michael can you please work with netdev to fix this in the > >upstream, and hopefully -stable, kernels? My guess is you will need > >to rebase your v2 patch on top of the v1 patch (basically what exists > >in upstream) and send that back out. > > I'm just going to drop this one for now (it never made it in). If there > is a follow-up you do want us to queue please let us know :) Thanks Sasha. The lore link below is the v2 version of the patch and it is worth merging as a fix into the older kernels. * https://lore.kernel.org/linux-security-module/18f0171e-0cc8-6ae6-d04a-a69a2a3c1a39@linux.alibaba.com -- paul moore www.paul-moore.com ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-09-07 13:07 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20210830115942.1017300-1-sashal@kernel.org>
2021-08-30 11:59 ` [PATCH AUTOSEL 5.13 13/14] net: fix NULL pointer reference in cipso_v4_doi_free Sasha Levin
2021-08-30 12:42 ` Dongliang Mu
2021-08-30 14:20 ` Paul Moore
2021-09-05 12:54 ` Sasha Levin
2021-09-07 13:06 ` Paul Moore
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).