* [PATCH] xfrm: Oops on error in pfkey_msg2xfrm_state()
@ 2017-06-14 10:34 Dan Carpenter
2017-06-15 11:56 ` Steffen Klassert
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2017-06-14 10:34 UTC (permalink / raw)
To: Steffen Klassert; +Cc: Herbert Xu, David S. Miller, netdev, kernel-janitors
There are some missing error codes here so we accidentally return NULL
instead of an error pointer. It results in a NULL pointer dereference.
Fixes: df71837d5024 ("[LSM-IPSec]: Security association restriction.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
This goes through Steffen's tree I presume. It aplies to net.
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 86051b5879f2..0fa678fa3b73 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1168,8 +1168,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
if (key)
keysize = (key->sadb_key_bits + 7) / 8;
x->aalg = kmalloc(sizeof(*x->aalg) + keysize, GFP_KERNEL);
- if (!x->aalg)
+ if (!x->aalg) {
+ err = -ENOMEM;
goto out;
+ }
strcpy(x->aalg->alg_name, a->name);
x->aalg->alg_key_len = 0;
if (key) {
@@ -1188,8 +1190,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
goto out;
}
x->calg = kmalloc(sizeof(*x->calg), GFP_KERNEL);
- if (!x->calg)
+ if (!x->calg) {
+ err = -ENOMEM;
goto out;
+ }
strcpy(x->calg->alg_name, a->name);
x->props.calgo = sa->sadb_sa_encrypt;
} else {
@@ -1203,8 +1207,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
if (key)
keysize = (key->sadb_key_bits + 7) / 8;
x->ealg = kmalloc(sizeof(*x->ealg) + keysize, GFP_KERNEL);
- if (!x->ealg)
+ if (!x->ealg) {
+ err = -ENOMEM;
goto out;
+ }
strcpy(x->ealg->alg_name, a->name);
x->ealg->alg_key_len = 0;
if (key) {
@@ -1249,8 +1255,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
struct xfrm_encap_tmpl *natt;
x->encap = kmalloc(sizeof(*x->encap), GFP_KERNEL);
- if (!x->encap)
+ if (!x->encap) {
+ err = -ENOMEM;
goto out;
+ }
natt = x->encap;
n_type = ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1];
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] xfrm: Oops on error in pfkey_msg2xfrm_state()
2017-06-14 10:34 [PATCH] xfrm: Oops on error in pfkey_msg2xfrm_state() Dan Carpenter
@ 2017-06-15 11:56 ` Steffen Klassert
0 siblings, 0 replies; 2+ messages in thread
From: Steffen Klassert @ 2017-06-15 11:56 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Herbert Xu, David S. Miller, netdev, kernel-janitors
On Wed, Jun 14, 2017 at 01:34:05PM +0300, Dan Carpenter wrote:
> There are some missing error codes here so we accidentally return NULL
> instead of an error pointer. It results in a NULL pointer dereference.
>
> Fixes: df71837d5024 ("[LSM-IPSec]: Security association restriction.")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Patch applied, thanks!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-06-15 11:57 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-06-14 10:34 [PATCH] xfrm: Oops on error in pfkey_msg2xfrm_state() Dan Carpenter
2017-06-15 11:56 ` Steffen Klassert
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).