Fw: [Bug 78161] New: Missing NULL check of the return value of nla_nest_start() in function sfb_dump()

Fw: [Bug 78161] New: Missing NULL check of the return value of nla_nest_start() in function sfb_dump()

[Stephen Hemminger]

Begin forwarded message:

Date: Tue, 17 Jun 2014 04:54:08 -0700
From: "bugzilla-daemon@bugzilla.kernel.org" <bugzilla-daemon@bugzilla.kernel.org>
To: "stephen@networkplumber.org" <stephen@networkplumber.org>
Subject: [Bug 78161] New: Missing NULL check of the return value of nla_nest_start() in function sfb_dump()


https://bugzilla.kernel.org/show_bug.cgi?id=78161

            Bug ID: 78161
           Summary: Missing NULL check of the return value of
                    nla_nest_start() in function sfb_dump()
           Product: Networking
           Version: 2.5
    Kernel Version: 2.6.39
          Hardware: All
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: Other
          Assignee: shemminger@linux-foundation.org
          Reporter: rucsoftsec@gmail.com
        Regression: No

Function nla_nest_start() may return a NULL pointer, and its return value shall
be checked before used. But in function sfb_dump() after nla_nest_start() is
called(at net/sched/sch_sfb.c:559), the return value is immediately used as a
parameter of nla_nest_end() without NULL check. Besides, there is no check
before the parameter is dereferenced in the callee function nla_nest_end(). So
an invalid memory access may be triggered.
The related code snippets in sfb_dump() are as following.
sfb_dump() @@net/sched/sch_sfb.c:559
559         opts = nla_nest_start(skb, TCA_OPTIONS);
560         NLA_PUT(skb, TCA_SFB_PARMS, sizeof(opt), &opt);
561         return nla_nest_end(skb, opts);

Generally, the return value of nla_nest_start() shall be checked against NULL
before it is used, like the following code snippets in function mk_reply().
mk_reply @ kernel/taskstats.c:364
364 static struct taskstats *mk_reply(struct sk_buff *skb, int type, u32 pid)
365 {
366         struct nlattr *na, *ret;
367         int aggr;
368 
369         aggr = (type == TASKSTATS_TYPE_PID)
370                         ? TASKSTATS_TYPE_AGGR_PID
371                         : TASKSTATS_TYPE_AGGR_TGID;
372 
    ...
392 #ifdef TASKSTATS_NEEDS_PADDING
393         if (nla_put(skb, TASKSTATS_TYPE_NULL, 0, NULL) < 0)
394                 goto err;
395 #endif
396         na = nla_nest_start(skb, aggr);
397         if (!na)
398                 goto err;
399 
400         if (nla_put(skb, type, sizeof(pid), &pid) < 0)
401                 goto err;
    ...
409         return NULL;
410 }

Thak you!

RUC_Soft_Sec, supported by China.X.Orion

-- 
You are receiving this mail because:
You are the assignee for the bug.

Re: Fw: [Bug 78161] New: Missing NULL check of the return value of nla_nest_start() in function sfb_dump()

[Cong Wang]

On Tue, Jun 17, 2014 at 1:52 PM, Stephen Hemminger
<stephen@networkplumber.org> wrote:
> Function nla_nest_start() may return a NULL pointer, and its return value shall
> be checked before used. But in function sfb_dump() after nla_nest_start() is
> called(at net/sched/sch_sfb.c:559), the return value is immediately used as a
> parameter of nla_nest_end() without NULL check. Besides, there is no check
> before the parameter is dereferenced in the callee function nla_nest_end(). So
> an invalid memory access may be triggered.
> The related code snippets in sfb_dump() are as following.
> sfb_dump() @@net/sched/sch_sfb.c:559
> 559         opts = nla_nest_start(skb, TCA_OPTIONS);
> 560         NLA_PUT(skb, TCA_SFB_PARMS, sizeof(opt), &opt);
> 561         return nla_nest_end(skb, opts);

This was fixed by:

commit 7ac2908e4b2edaec60e9090ddb4d9ceb76c05e7d
Author: Alan Cox <alan@linux.intel.com>
Date:   Thu Jul 12 03:39:11 2012 +0000

    sch_sfb: Fix missing NULL check