* [PATCH] net: ipv4: Potential null pointer dereference in cipso_v4_parsetag_enum
@ 2025-09-08 8:03 Chen Yufeng
2025-09-08 10:09 ` Vadim Fedorenko
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: Chen Yufeng @ 2025-09-08 8:03 UTC (permalink / raw)
To: paul; +Cc: davem, dsahern, netdev, Chen Yufeng
While parsing CIPSO enumerated tags, secattr->flags is set to
NETLBL_SECATTR_MLS_CAT even if secattr->attr.mls.cat is NULL.
If subsequent code attempts to access secattr->attr.mls.cat,
it may lead to a null pointer dereference, causing a system crash.
To address this issue, we add a check to ensure that before setting
the NETLBL_SECATTR_MLS_CAT flag, secattr->attr.mls.cat is not NULL.
fixed code:
```
if (secattr->attr.mls.cat)
secattr->flags |= NETLBL_SECATTR_MLS_CAT;
```
This patch is similar to eead1c2ea250("netlabel: cope with NULL catmap").
Signed-off-by: Chen Yufeng <chenyufeng@iie.ac.cn>
---
net/ipv4/cipso_ipv4.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 740af8541d2f..2190333d78cb 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -1339,8 +1339,8 @@ static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
netlbl_catmap_free(secattr->attr.mls.cat);
return ret_val;
}
-
- secattr->flags |= NETLBL_SECATTR_MLS_CAT;
+ if (secattr->attr.mls.cat)
+ secattr->flags |= NETLBL_SECATTR_MLS_CAT;
}
return 0;
--
2.34.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] net: ipv4: Potential null pointer dereference in cipso_v4_parsetag_enum
2025-09-08 8:03 [PATCH] net: ipv4: Potential null pointer dereference in cipso_v4_parsetag_enum Chen Yufeng
@ 2025-09-08 10:09 ` Vadim Fedorenko
2025-09-08 14:56 ` Paul Moore
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Vadim Fedorenko @ 2025-09-08 10:09 UTC (permalink / raw)
To: Chen Yufeng, paul; +Cc: davem, dsahern, netdev
On 08/09/2025 09:03, Chen Yufeng wrote:
> While parsing CIPSO enumerated tags, secattr->flags is set to
> NETLBL_SECATTR_MLS_CAT even if secattr->attr.mls.cat is NULL.
> If subsequent code attempts to access secattr->attr.mls.cat,
> it may lead to a null pointer dereference, causing a system crash.
>
> To address this issue, we add a check to ensure that before setting
> the NETLBL_SECATTR_MLS_CAT flag, secattr->attr.mls.cat is not NULL.
>
> fixed code:
> ```
> if (secattr->attr.mls.cat)
> secattr->flags |= NETLBL_SECATTR_MLS_CAT;
> ```
>
> This patch is similar to eead1c2ea250("netlabel: cope with NULL catmap").
>
> Signed-off-by: Chen Yufeng <chenyufeng@iie.ac.cn>
> ---
> net/ipv4/cipso_ipv4.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
> index 740af8541d2f..2190333d78cb 100644
> --- a/net/ipv4/cipso_ipv4.c
> +++ b/net/ipv4/cipso_ipv4.c
> @@ -1339,8 +1339,8 @@ static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
> netlbl_catmap_free(secattr->attr.mls.cat);
> return ret_val;
> }
> -
> - secattr->flags |= NETLBL_SECATTR_MLS_CAT;
> + if (secattr->attr.mls.cat)
> + secattr->flags |= NETLBL_SECATTR_MLS_CAT;
> }
>
> return 0;
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] net: ipv4: Potential null pointer dereference in cipso_v4_parsetag_enum
2025-09-08 8:03 [PATCH] net: ipv4: Potential null pointer dereference in cipso_v4_parsetag_enum Chen Yufeng
2025-09-08 10:09 ` Vadim Fedorenko
@ 2025-09-08 14:56 ` Paul Moore
2025-09-09 12:47 ` Simon Horman
2025-09-10 0:09 ` Jakub Kicinski
3 siblings, 0 replies; 5+ messages in thread
From: Paul Moore @ 2025-09-08 14:56 UTC (permalink / raw)
To: Chen Yufeng; +Cc: davem, dsahern, netdev
On Mon, Sep 8, 2025 at 4:03 AM Chen Yufeng <chenyufeng@iie.ac.cn> wrote:
>
> While parsing CIPSO enumerated tags, secattr->flags is set to
> NETLBL_SECATTR_MLS_CAT even if secattr->attr.mls.cat is NULL.
> If subsequent code attempts to access secattr->attr.mls.cat,
> it may lead to a null pointer dereference, causing a system crash.
>
> To address this issue, we add a check to ensure that before setting
> the NETLBL_SECATTR_MLS_CAT flag, secattr->attr.mls.cat is not NULL.
>
> fixed code:
> ```
> if (secattr->attr.mls.cat)
> secattr->flags |= NETLBL_SECATTR_MLS_CAT;
> ```
>
> This patch is similar to eead1c2ea250("netlabel: cope with NULL catmap").
>
> Signed-off-by: Chen Yufeng <chenyufeng@iie.ac.cn>
> ---
> net/ipv4/cipso_ipv4.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
Acked-by: Paul Moore <paul@paul-moore.com>
--
paul-moore.com
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] net: ipv4: Potential null pointer dereference in cipso_v4_parsetag_enum
2025-09-08 8:03 [PATCH] net: ipv4: Potential null pointer dereference in cipso_v4_parsetag_enum Chen Yufeng
2025-09-08 10:09 ` Vadim Fedorenko
2025-09-08 14:56 ` Paul Moore
@ 2025-09-09 12:47 ` Simon Horman
2025-09-10 0:09 ` Jakub Kicinski
3 siblings, 0 replies; 5+ messages in thread
From: Simon Horman @ 2025-09-09 12:47 UTC (permalink / raw)
To: Chen Yufeng; +Cc: paul, davem, dsahern, netdev
On Mon, Sep 08, 2025 at 04:03:15PM +0800, Chen Yufeng wrote:
> While parsing CIPSO enumerated tags, secattr->flags is set to
> NETLBL_SECATTR_MLS_CAT even if secattr->attr.mls.cat is NULL.
> If subsequent code attempts to access secattr->attr.mls.cat,
> it may lead to a null pointer dereference, causing a system crash.
>
> To address this issue, we add a check to ensure that before setting
> the NETLBL_SECATTR_MLS_CAT flag, secattr->attr.mls.cat is not NULL.
>
> fixed code:
> ```
> if (secattr->attr.mls.cat)
> secattr->flags |= NETLBL_SECATTR_MLS_CAT;
> ```
>
> This patch is similar to eead1c2ea250("netlabel: cope with NULL catmap").
Nit: the preferred form for this citation is:
commit eead1c2ea250 ("netlabel: cope with NULL catmap")
i.e.
This patch is similar to commit eead1c2ea250 ("netlabel: cope with NULL
catmap").
>
> Signed-off-by: Chen Yufeng <chenyufeng@iie.ac.cn>
> ---
> net/ipv4/cipso_ipv4.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
> index 740af8541d2f..2190333d78cb 100644
> --- a/net/ipv4/cipso_ipv4.c
> +++ b/net/ipv4/cipso_ipv4.c
> @@ -1339,8 +1339,8 @@ static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
> netlbl_catmap_free(secattr->attr.mls.cat);
> return ret_val;
> }
> -
> - secattr->flags |= NETLBL_SECATTR_MLS_CAT;
> + if (secattr->attr.mls.cat)
> + secattr->flags |= NETLBL_SECATTR_MLS_CAT;
> }
>
> return 0;
> --
> 2.34.1
>
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] net: ipv4: Potential null pointer dereference in cipso_v4_parsetag_enum
2025-09-08 8:03 [PATCH] net: ipv4: Potential null pointer dereference in cipso_v4_parsetag_enum Chen Yufeng
` (2 preceding siblings ...)
2025-09-09 12:47 ` Simon Horman
@ 2025-09-10 0:09 ` Jakub Kicinski
3 siblings, 0 replies; 5+ messages in thread
From: Jakub Kicinski @ 2025-09-10 0:09 UTC (permalink / raw)
To: Chen Yufeng; +Cc: paul, davem, dsahern, netdev
On Mon, 8 Sep 2025 16:03:15 +0800 Chen Yufeng wrote:
> While parsing CIPSO enumerated tags, secattr->flags is set to
> NETLBL_SECATTR_MLS_CAT even if secattr->attr.mls.cat is NULL.
> If subsequent code attempts to access secattr->attr.mls.cat,
> it may lead to a null pointer dereference, causing a system crash.
>
> To address this issue, we add a check to ensure that before setting
> the NETLBL_SECATTR_MLS_CAT flag, secattr->attr.mls.cat is not NULL.
>
> fixed code:
> ```
> if (secattr->attr.mls.cat)
> secattr->flags |= NETLBL_SECATTR_MLS_CAT;
> ```
>
> This patch is similar to eead1c2ea250("netlabel: cope with NULL catmap").
Please add appropriate Fixes tags indicating the earliest commit where
issue may trigger.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2025-09-10 0:09 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-09-08 8:03 [PATCH] net: ipv4: Potential null pointer dereference in cipso_v4_parsetag_enum Chen Yufeng
2025-09-08 10:09 ` Vadim Fedorenko
2025-09-08 14:56 ` Paul Moore
2025-09-09 12:47 ` Simon Horman
2025-09-10 0:09 ` Jakub Kicinski
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).