From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Miller Subject: Re: [PATCH net-next] rtnetlink: Fix null-ptr-deref in rtnl_newlink Date: Fri, 01 Jun 2018 10:39:55 -0400 (EDT) Message-ID: <20180601.103955.560700444664349840.davem@davemloft.net> References: <20180601081658.6968-1-bhole_prashant_q7@lab.ntt.co.jp> Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: edumazet@google.com, daniel@iogearbox.net, ast@kernel.org, ktkhai@virtuozzo.com, fw@strlen.de, netdev@vger.kernel.org To: bhole_prashant_q7@lab.ntt.co.jp Return-path: Received: from shards.monkeyblade.net ([184.105.139.130]:46588 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751378AbeFAOj5 (ORCPT ); Fri, 1 Jun 2018 10:39:57 -0400 In-Reply-To: <20180601081658.6968-1-bhole_prashant_q7@lab.ntt.co.jp> Sender: netdev-owner@vger.kernel.org List-ID: From: Prashant Bhole Date: Fri, 1 Jun 2018 17:16:58 +0900 > In rtnl_newlink(), NULL check is performed on m_ops however member of > ops is accessed. Fixed by accessing member of m_ops instead of ops. > > [ 345.432629] BUG: KASAN: null-ptr-deref in rtnl_newlink+0x400/0x1110 > [ 345.432629] Read of size 4 at addr 0000000000000088 by task ip/986 > [ 345.432629] > [ 345.432629] CPU: 1 PID: 986 Comm: ip Not tainted 4.17.0-rc6+ #9 > [ 345.432629] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 > [ 345.432629] Call Trace: > [ 345.432629] dump_stack+0xc6/0x150 > [ 345.432629] ? dump_stack_print_info.cold.0+0x1b/0x1b > [ 345.432629] ? kasan_report+0xb4/0x410 > [ 345.432629] kasan_report.cold.4+0x8f/0x91 > [ 345.432629] ? rtnl_newlink+0x400/0x1110 > [ 345.432629] rtnl_newlink+0x400/0x1110 > [...] > > Fixes: ccf8dbcd062a ("rtnetlink: Remove VLA usage") > Signed-off-by: Prashant Bhole Applied, thanks.