[BUG] net: xfrm: possible null-pointer dereferences in xfrm_policy()

[BUG] net: xfrm: possible null-pointer dereferences in xfrm_policy()

[Jia-Ju Bai]

In xfrm_policy(), the while loop on lines 3802-3830 ends when dst->xfrm 
is NULL.
Then, dst->xfrm is used on line 3840:
     xfrm_state_mtu(dst->xfrm, mtu);
         if (x->km.state != XFRM_STATE_VALID...)
         aead = x->data;

Thus, possible null-pointer dereferences may occur.

These bugs are found by a static analysis tool STCheck written by us.

I do not know how to correctly fix these bugs, so I only report them.


Best wishes,
Jia-Ju Bai

Re: [BUG] net: xfrm: possible null-pointer dereferences in xfrm_policy()

[Steffen Klassert]

On Mon, Jul 29, 2019 at 11:43:49AM +0800, Jia-Ju Bai wrote:
> In xfrm_policy(), the while loop on lines 3802-3830 ends when dst->xfrm is
> NULL.

We don't have a xfrm_policy() function, and as said already the
line numbers does not help much as long as you don't say which
tree/branch this is and which commit is the head commit.

> Then, dst->xfrm is used on line 3840:
>     xfrm_state_mtu(dst->xfrm, mtu);
>         if (x->km.state != XFRM_STATE_VALID...)
>         aead = x->data;
> 
> Thus, possible null-pointer dereferences may occur.

I guess you refer to xfrm_bundle_ok(). The dst pointer
is reoaded after the loop, so the dereferenced pointer
is not the one that had NULL at dst->xfrm.

> 
> These bugs are found by a static analysis tool STCheck written by us.
> 
> I do not know how to correctly fix these bugs, so I only report them.

I'd suggest you to manually review the reports of your
tool and to fix the tool accordingly.

Re: [BUG] net: xfrm: possible null-pointer dereferences in xfrm_policy()

[Jia-Ju Bai]

On 2019/7/29 16:03, Steffen Klassert wrote:
> On Mon, Jul 29, 2019 at 11:43:49AM +0800, Jia-Ju Bai wrote:
>> In xfrm_policy(), the while loop on lines 3802-3830 ends when dst->xfrm is
>> NULL.
> We don't have a xfrm_policy() function, and as said already the
> line numbers does not help much as long as you don't say which
> tree/branch this is and which commit is the head commit.
>
>> Then, dst->xfrm is used on line 3840:
>>      xfrm_state_mtu(dst->xfrm, mtu);
>>          if (x->km.state != XFRM_STATE_VALID...)
>>          aead = x->data;
>>
>> Thus, possible null-pointer dereferences may occur.
> I guess you refer to xfrm_bundle_ok(). The dst pointer
> is reoaded after the loop, so the dereferenced pointer
> is not the one that had NULL at dst->xfrm.
>
>> These bugs are found by a static analysis tool STCheck written by us.
>>
>> I do not know how to correctly fix these bugs, so I only report them.
> I'd suggest you to manually review the reports of your
> tool and to fix the tool accordingly.

Oh, sorry for my mistakes.
I have found that dst is updated:
     dst = &xdst->u.dst;

I will fix my tool, thanks.


Best wishes,
Jia-Ju Bai