* Re: [PATCH] net: ipv4: Potential null pointer dereference in cipso_v4_parsetag_enum
2025-09-08 8:03 [PATCH] net: ipv4: Potential null pointer dereference in cipso_v4_parsetag_enum Chen Yufeng
@ 2025-09-08 10:09 ` Vadim Fedorenko
2025-09-08 14:56 ` Paul Moore
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Vadim Fedorenko @ 2025-09-08 10:09 UTC (permalink / raw)
To: Chen Yufeng, paul; +Cc: davem, dsahern, netdev
On 08/09/2025 09:03, Chen Yufeng wrote:
> While parsing CIPSO enumerated tags, secattr->flags is set to
> NETLBL_SECATTR_MLS_CAT even if secattr->attr.mls.cat is NULL.
> If subsequent code attempts to access secattr->attr.mls.cat,
> it may lead to a null pointer dereference, causing a system crash.
>
> To address this issue, we add a check to ensure that before setting
> the NETLBL_SECATTR_MLS_CAT flag, secattr->attr.mls.cat is not NULL.
>
> fixed code:
> ```
> if (secattr->attr.mls.cat)
> secattr->flags |= NETLBL_SECATTR_MLS_CAT;
> ```
>
> This patch is similar to eead1c2ea250("netlabel: cope with NULL catmap").
>
> Signed-off-by: Chen Yufeng <chenyufeng@iie.ac.cn>
> ---
> net/ipv4/cipso_ipv4.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
> index 740af8541d2f..2190333d78cb 100644
> --- a/net/ipv4/cipso_ipv4.c
> +++ b/net/ipv4/cipso_ipv4.c
> @@ -1339,8 +1339,8 @@ static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
> netlbl_catmap_free(secattr->attr.mls.cat);
> return ret_val;
> }
> -
> - secattr->flags |= NETLBL_SECATTR_MLS_CAT;
> + if (secattr->attr.mls.cat)
> + secattr->flags |= NETLBL_SECATTR_MLS_CAT;
> }
>
> return 0;
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] net: ipv4: Potential null pointer dereference in cipso_v4_parsetag_enum
2025-09-08 8:03 [PATCH] net: ipv4: Potential null pointer dereference in cipso_v4_parsetag_enum Chen Yufeng
2025-09-08 10:09 ` Vadim Fedorenko
@ 2025-09-08 14:56 ` Paul Moore
2025-09-09 12:47 ` Simon Horman
2025-09-10 0:09 ` Jakub Kicinski
3 siblings, 0 replies; 5+ messages in thread
From: Paul Moore @ 2025-09-08 14:56 UTC (permalink / raw)
To: Chen Yufeng; +Cc: davem, dsahern, netdev
On Mon, Sep 8, 2025 at 4:03 AM Chen Yufeng <chenyufeng@iie.ac.cn> wrote:
>
> While parsing CIPSO enumerated tags, secattr->flags is set to
> NETLBL_SECATTR_MLS_CAT even if secattr->attr.mls.cat is NULL.
> If subsequent code attempts to access secattr->attr.mls.cat,
> it may lead to a null pointer dereference, causing a system crash.
>
> To address this issue, we add a check to ensure that before setting
> the NETLBL_SECATTR_MLS_CAT flag, secattr->attr.mls.cat is not NULL.
>
> fixed code:
> ```
> if (secattr->attr.mls.cat)
> secattr->flags |= NETLBL_SECATTR_MLS_CAT;
> ```
>
> This patch is similar to eead1c2ea250("netlabel: cope with NULL catmap").
>
> Signed-off-by: Chen Yufeng <chenyufeng@iie.ac.cn>
> ---
> net/ipv4/cipso_ipv4.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
Acked-by: Paul Moore <paul@paul-moore.com>
--
paul-moore.com
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] net: ipv4: Potential null pointer dereference in cipso_v4_parsetag_enum
2025-09-08 8:03 [PATCH] net: ipv4: Potential null pointer dereference in cipso_v4_parsetag_enum Chen Yufeng
2025-09-08 10:09 ` Vadim Fedorenko
2025-09-08 14:56 ` Paul Moore
@ 2025-09-09 12:47 ` Simon Horman
2025-09-10 0:09 ` Jakub Kicinski
3 siblings, 0 replies; 5+ messages in thread
From: Simon Horman @ 2025-09-09 12:47 UTC (permalink / raw)
To: Chen Yufeng; +Cc: paul, davem, dsahern, netdev
On Mon, Sep 08, 2025 at 04:03:15PM +0800, Chen Yufeng wrote:
> While parsing CIPSO enumerated tags, secattr->flags is set to
> NETLBL_SECATTR_MLS_CAT even if secattr->attr.mls.cat is NULL.
> If subsequent code attempts to access secattr->attr.mls.cat,
> it may lead to a null pointer dereference, causing a system crash.
>
> To address this issue, we add a check to ensure that before setting
> the NETLBL_SECATTR_MLS_CAT flag, secattr->attr.mls.cat is not NULL.
>
> fixed code:
> ```
> if (secattr->attr.mls.cat)
> secattr->flags |= NETLBL_SECATTR_MLS_CAT;
> ```
>
> This patch is similar to eead1c2ea250("netlabel: cope with NULL catmap").
Nit: the preferred form for this citation is:
commit eead1c2ea250 ("netlabel: cope with NULL catmap")
i.e.
This patch is similar to commit eead1c2ea250 ("netlabel: cope with NULL
catmap").
>
> Signed-off-by: Chen Yufeng <chenyufeng@iie.ac.cn>
> ---
> net/ipv4/cipso_ipv4.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
> index 740af8541d2f..2190333d78cb 100644
> --- a/net/ipv4/cipso_ipv4.c
> +++ b/net/ipv4/cipso_ipv4.c
> @@ -1339,8 +1339,8 @@ static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
> netlbl_catmap_free(secattr->attr.mls.cat);
> return ret_val;
> }
> -
> - secattr->flags |= NETLBL_SECATTR_MLS_CAT;
> + if (secattr->attr.mls.cat)
> + secattr->flags |= NETLBL_SECATTR_MLS_CAT;
> }
>
> return 0;
> --
> 2.34.1
>
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] net: ipv4: Potential null pointer dereference in cipso_v4_parsetag_enum
2025-09-08 8:03 [PATCH] net: ipv4: Potential null pointer dereference in cipso_v4_parsetag_enum Chen Yufeng
` (2 preceding siblings ...)
2025-09-09 12:47 ` Simon Horman
@ 2025-09-10 0:09 ` Jakub Kicinski
3 siblings, 0 replies; 5+ messages in thread
From: Jakub Kicinski @ 2025-09-10 0:09 UTC (permalink / raw)
To: Chen Yufeng; +Cc: paul, davem, dsahern, netdev
On Mon, 8 Sep 2025 16:03:15 +0800 Chen Yufeng wrote:
> While parsing CIPSO enumerated tags, secattr->flags is set to
> NETLBL_SECATTR_MLS_CAT even if secattr->attr.mls.cat is NULL.
> If subsequent code attempts to access secattr->attr.mls.cat,
> it may lead to a null pointer dereference, causing a system crash.
>
> To address this issue, we add a check to ensure that before setting
> the NETLBL_SECATTR_MLS_CAT flag, secattr->attr.mls.cat is not NULL.
>
> fixed code:
> ```
> if (secattr->attr.mls.cat)
> secattr->flags |= NETLBL_SECATTR_MLS_CAT;
> ```
>
> This patch is similar to eead1c2ea250("netlabel: cope with NULL catmap").
Please add appropriate Fixes tags indicating the earliest commit where
issue may trigger.
^ permalink raw reply [flat|nested] 5+ messages in thread