[Patch net] gtp: fix a potential NULL pointer dereference

[Patch net] gtp: fix a potential NULL pointer dereference

[Cong Wang]

From: Cong Wang <cong.wang@bytedance.com>

When sockfd_lookup() fails, gtp_encap_enable_socket() returns a
NULL pointer, but its callers only check for error pointers thus miss
the NULL pointer case.

Fix it by returning an error pointer with the error code carried from
sockfd_lookup().

(I found this bug during code inspection.)

Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional")
Cc: Andreas Schultz <aschultz@tpip.net>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Harald Welte <laforge@gnumonks.org>
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
---
 drivers/net/gtp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 0696faf60013..2e94d10348cc 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -1653,7 +1653,7 @@ static struct sock *gtp_encap_enable_socket(int fd, int type,
 	sock = sockfd_lookup(fd, &err);
 	if (!sock) {
 		pr_debug("gtp socket fd=%d not found\n", fd);
-		return NULL;
+		return ERR_PTR(err);
 	}
 
 	sk = sock->sk;
-- 
2.34.1

Re: [Patch net] gtp: fix a potential NULL pointer dereference

[Simon Horman]

On Sun, Aug 25, 2024 at 12:16:38PM -0700, Cong Wang wrote:
> From: Cong Wang <cong.wang@bytedance.com>
> 
> When sockfd_lookup() fails, gtp_encap_enable_socket() returns a
> NULL pointer, but its callers only check for error pointers thus miss
> the NULL pointer case.
> 
> Fix it by returning an error pointer with the error code carried from
> sockfd_lookup().
> 
> (I found this bug during code inspection.)
> 
> Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional")
> Cc: Andreas Schultz <aschultz@tpip.net>
> Cc: Pablo Neira Ayuso <pablo@netfilter.org>
> Cc: Harald Welte <laforge@gnumonks.org>
> Signed-off-by: Cong Wang <cong.wang@bytedance.com>

Thanks Cong,

I agree with your analysis.

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [Patch net] gtp: fix a potential NULL pointer dereference

[Pablo Neira Ayuso]

On Sun, Aug 25, 2024 at 12:16:38PM -0700, Cong Wang wrote:
> From: Cong Wang <cong.wang@bytedance.com>
> 
> When sockfd_lookup() fails, gtp_encap_enable_socket() returns a
> NULL pointer, but its callers only check for error pointers thus miss
> the NULL pointer case.
> 
> Fix it by returning an error pointer with the error code carried from
> sockfd_lookup().
> 
> (I found this bug during code inspection.)
> 
> Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional")
> Cc: Andreas Schultz <aschultz@tpip.net>
> Cc: Pablo Neira Ayuso <pablo@netfilter.org>
> Cc: Harald Welte <laforge@gnumonks.org>
> Signed-off-by: Cong Wang <cong.wang@bytedance.com>

Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>

Thanks.

Re: [Patch net] gtp: fix a potential NULL pointer dereference

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Sun, 25 Aug 2024 12:16:38 -0700 you wrote:
> From: Cong Wang <cong.wang@bytedance.com>
> 
> When sockfd_lookup() fails, gtp_encap_enable_socket() returns a
> NULL pointer, but its callers only check for error pointers thus miss
> the NULL pointer case.
> 
> Fix it by returning an error pointer with the error code carried from
> sockfd_lookup().
> 
> [...]

Here is the summary with links:
  - [net] gtp: fix a potential NULL pointer dereference
    https://git.kernel.org/netdev/net/c/defd8b3c37b0

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html