* [PATCH net] net: fib: fib6_add: fix potential NULL pointer dereference
@ 2013-09-07 13:13 Daniel Borkmann
2013-09-07 19:35 ` Hannes Frederic Sowa
0 siblings, 1 reply; 4+ messages in thread
From: Daniel Borkmann @ 2013-09-07 13:13 UTC (permalink / raw)
To: davem; +Cc: netdev, Lin Ming, Matti Vaittinen, Hannes Frederic Sowa
When the kernel is compiled with CONFIG_IPV6_SUBTREES, and we return
with an error in fn = fib6_add_1(), then error codes are encoded into
the return pointer e.g. ERR_PTR(-ENOENT). In such an error case, we
write the error code into err and jump to out, hence enter the if(err)
condition. Now, if CONFIG_IPV6_SUBTREES is enabled, we check for:
if (pn != fn && pn->leaf == rt)
...
if (pn != fn && !pn->leaf && !(pn->fn_flags & RTN_RTINFO))
...
Since pn is NULL and fn is f.e. ERR_PTR(-ENOENT), then pn != fn
evaluates to true and causes a NULL-pointer dereference on further
checks on pn. Fix it, by setting both NULL in error case, so that
pn != fn already evaluates to false and no further dereference
takes place.
This was first correctly implemented in 4a287eba2 ("IPv6 routing,
NLM_F_* flag support: REPLACE and EXCL flags support, warn about
missing CREATE flag"), but the bug got later on introduced by
188c517a0 ("ipv6: return errno pointers consistently for fib6_add_1()").
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Lin Ming <mlin@ss.pku.edu.cn>
Cc: Matti Vaittinen <matti.vaittinen@nsn.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
---
net/ipv6/ip6_fib.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 73db48e..5bec666 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -825,9 +825,9 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info)
fn = fib6_add_1(root, &rt->rt6i_dst.addr, rt->rt6i_dst.plen,
offsetof(struct rt6_info, rt6i_dst), allow_create,
replace_required);
-
if (IS_ERR(fn)) {
err = PTR_ERR(fn);
+ fn = NULL;
goto out;
}
--
1.7.11.7
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH net] net: fib: fib6_add: fix potential NULL pointer dereference
2013-09-07 13:13 [PATCH net] net: fib: fib6_add: fix potential NULL pointer dereference Daniel Borkmann
@ 2013-09-07 19:35 ` Hannes Frederic Sowa
2013-09-09 6:26 ` Matti Vaittinen
0 siblings, 1 reply; 4+ messages in thread
From: Hannes Frederic Sowa @ 2013-09-07 19:35 UTC (permalink / raw)
To: Daniel Borkmann; +Cc: davem, netdev, Lin Ming, Matti Vaittinen
On Sat, Sep 07, 2013 at 03:13:20PM +0200, Daniel Borkmann wrote:
> When the kernel is compiled with CONFIG_IPV6_SUBTREES, and we return
> with an error in fn = fib6_add_1(), then error codes are encoded into
> the return pointer e.g. ERR_PTR(-ENOENT). In such an error case, we
> write the error code into err and jump to out, hence enter the if(err)
> condition. Now, if CONFIG_IPV6_SUBTREES is enabled, we check for:
>
> if (pn != fn && pn->leaf == rt)
> ...
> if (pn != fn && !pn->leaf && !(pn->fn_flags & RTN_RTINFO))
> ...
>
> Since pn is NULL and fn is f.e. ERR_PTR(-ENOENT), then pn != fn
> evaluates to true and causes a NULL-pointer dereference on further
> checks on pn. Fix it, by setting both NULL in error case, so that
> pn != fn already evaluates to false and no further dereference
> takes place.
>
> This was first correctly implemented in 4a287eba2 ("IPv6 routing,
> NLM_F_* flag support: REPLACE and EXCL flags support, warn about
> missing CREATE flag"), but the bug got later on introduced by
> 188c517a0 ("ipv6: return errno pointers consistently for fib6_add_1()").
>
> Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
> Cc: Lin Ming <mlin@ss.pku.edu.cn>
> Cc: Matti Vaittinen <matti.vaittinen@nsn.com>
> Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Full ACK!
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH net] net: fib: fib6_add: fix potential NULL pointer dereference
2013-09-07 19:35 ` Hannes Frederic Sowa
@ 2013-09-09 6:26 ` Matti Vaittinen
2013-09-11 20:14 ` David Miller
0 siblings, 1 reply; 4+ messages in thread
From: Matti Vaittinen @ 2013-09-09 6:26 UTC (permalink / raw)
To: Daniel Borkmann, davem, netdev, Lin Ming
On 09/07/2013 10:35 PM, ext Hannes Frederic Sowa wrote:
> On Sat, Sep 07, 2013 at 03:13:20PM +0200, Daniel Borkmann wrote:
>> When the kernel is compiled with CONFIG_IPV6_SUBTREES, and we return
>> with an error in fn = fib6_add_1(), then error codes are encoded into
>> the return pointer e.g. ERR_PTR(-ENOENT). In such an error case, we
>> write the error code into err and jump to out, hence enter the if(err)
>> condition. Now, if CONFIG_IPV6_SUBTREES is enabled, we check for:
>>
>> if (pn != fn && pn->leaf == rt)
>> ...
>> if (pn != fn && !pn->leaf && !(pn->fn_flags & RTN_RTINFO))
>> ...
>>
>> Since pn is NULL and fn is f.e. ERR_PTR(-ENOENT), then pn != fn
>> evaluates to true and causes a NULL-pointer dereference on further
>> checks on pn. Fix it, by setting both NULL in error case, so that
>> pn != fn already evaluates to false and no further dereference
>> takes place.
>>
>> This was first correctly implemented in 4a287eba2 ("IPv6 routing,
>> NLM_F_* flag support: REPLACE and EXCL flags support, warn about
>> missing CREATE flag"), but the bug got later on introduced by
>> 188c517a0 ("ipv6: return errno pointers consistently for fib6_add_1()").
>>
>> Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
>> Cc: Lin Ming <mlin@ss.pku.edu.cn>
>> Cc: Matti Vaittinen <matti.vaittinen@nsn.com>
>> Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
>
> Full ACK!
>
> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
>
Acked-by: Matti Vaittinen <matti.vaittinen@nsn.com>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH net] net: fib: fib6_add: fix potential NULL pointer dereference
2013-09-09 6:26 ` Matti Vaittinen
@ 2013-09-11 20:14 ` David Miller
0 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2013-09-11 20:14 UTC (permalink / raw)
To: matti.vaittinen; +Cc: dborkman, netdev, mlin
From: Matti Vaittinen <matti.vaittinen@nsn.com>
Date: Mon, 09 Sep 2013 09:26:07 +0300
> On 09/07/2013 10:35 PM, ext Hannes Frederic Sowa wrote:
>> On Sat, Sep 07, 2013 at 03:13:20PM +0200, Daniel Borkmann wrote:
>>> When the kernel is compiled with CONFIG_IPV6_SUBTREES, and we return
>>> with an error in fn = fib6_add_1(), then error codes are encoded into
>>> the return pointer e.g. ERR_PTR(-ENOENT). In such an error case, we
>>> write the error code into err and jump to out, hence enter the if(err)
>>> condition. Now, if CONFIG_IPV6_SUBTREES is enabled, we check for:
>>>
>>> if (pn != fn && pn->leaf == rt)
>>> ...
>>> if (pn != fn && !pn->leaf && !(pn->fn_flags & RTN_RTINFO))
>>> ...
>>>
>>> Since pn is NULL and fn is f.e. ERR_PTR(-ENOENT), then pn != fn
>>> evaluates to true and causes a NULL-pointer dereference on further
>>> checks on pn. Fix it, by setting both NULL in error case, so that
>>> pn != fn already evaluates to false and no further dereference
>>> takes place.
>>>
>>> This was first correctly implemented in 4a287eba2 ("IPv6 routing,
>>> NLM_F_* flag support: REPLACE and EXCL flags support, warn about
>>> missing CREATE flag"), but the bug got later on introduced by
>>> 188c517a0 ("ipv6: return errno pointers consistently for
>>> fib6_add_1()").
>>>
>>> Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
>>> Cc: Lin Ming <mlin@ss.pku.edu.cn>
>>> Cc: Matti Vaittinen <matti.vaittinen@nsn.com>
>>> Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
>>
>> Full ACK!
>>
>> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
>>
> Acked-by: Matti Vaittinen <matti.vaittinen@nsn.com>
Applied, thanks everyone.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2013-09-11 20:14 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-09-07 13:13 [PATCH net] net: fib: fib6_add: fix potential NULL pointer dereference Daniel Borkmann
2013-09-07 19:35 ` Hannes Frederic Sowa
2013-09-09 6:26 ` Matti Vaittinen
2013-09-11 20:14 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).