* [patch] ipvs: freeing uninitialized pointer on error
@ 2013-01-25 15:44 Dan Carpenter
2013-01-25 20:56 ` Julian Anastasov
0 siblings, 1 reply; 5+ messages in thread
From: Dan Carpenter @ 2013-01-25 15:44 UTC (permalink / raw)
To: Wensong Zhang
Cc: Simon Horman, Julian Anastasov, Pablo Neira Ayuso,
Patrick McHardy, David S. Miller, netdev, lvs-devel,
netfilter-devel, netfilter, coreteam, kernel-janitors
If state != IP_VS_STATE_BACKUP then tinfo->buf is uninitialized. If
kthread_run() fails then it means we free random memory resulting in an
oops.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index effa10c..44fd10c 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -1795,6 +1795,8 @@ int start_sync_thread(struct net *net, int state, char *mcast_ifn, __u8 syncid)
GFP_KERNEL);
if (!tinfo->buf)
goto outtinfo;
+ } else {
+ tinfo->buf = NULL;
}
tinfo->id = id;
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [patch] ipvs: freeing uninitialized pointer on error
2013-01-25 15:44 [patch] ipvs: freeing uninitialized pointer on error Dan Carpenter
@ 2013-01-25 20:56 ` Julian Anastasov
0 siblings, 0 replies; 5+ messages in thread
From: Julian Anastasov @ 2013-01-25 20:56 UTC (permalink / raw)
To: Dan Carpenter
Cc: Wensong Zhang, Simon Horman, Pablo Neira Ayuso, Patrick McHardy,
David S. Miller, netdev, lvs-devel, netfilter-devel, netfilter,
coreteam, kernel-janitors
Hello,
On Fri, 25 Jan 2013, Dan Carpenter wrote:
> If state != IP_VS_STATE_BACKUP then tinfo->buf is uninitialized. If
> kthread_run() fails then it means we free random memory resulting in an
> oops.
Good catch. Simon, please apply!
Problem is in 3.5+ caused by commit f73181c828
(ipvs: add support for sync threads)
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
> diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
> index effa10c..44fd10c 100644
> --- a/net/netfilter/ipvs/ip_vs_sync.c
> +++ b/net/netfilter/ipvs/ip_vs_sync.c
> @@ -1795,6 +1795,8 @@ int start_sync_thread(struct net *net, int state, char *mcast_ifn, __u8 syncid)
> GFP_KERNEL);
> if (!tinfo->buf)
> goto outtinfo;
> + } else {
> + tinfo->buf = NULL;
> }
> tinfo->id = id;
Regards
--
Julian Anastasov <ja@ssi.bg>
^ permalink raw reply [flat|nested] 5+ messages in thread
* [GIT PULL nf] IPVS
@ 2013-01-28 1:18 Simon Horman
2013-01-28 1:18 ` [PATCH] ipvs: freeing uninitialized pointer on error Simon Horman
2013-02-05 2:58 ` [GIT PULL nf] IPVS Pablo Neira Ayuso
0 siblings, 2 replies; 5+ messages in thread
From: Simon Horman @ 2013-01-28 1:18 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: lvs-devel, netdev, netfilter-devel, Wensong Zhang,
Julian Anastasov, Hans Schillstrom, Hans Schillstrom,
Jesper Dangaard Brouer, Dan Carpenter
Hi Pablo,
please consider the following fix for IPVS patch for 3.8.
I believe that the problem was introduced in 3.4 and thus
this fix is appropriate for 3.4, 3.5, 3.6 and 3.7 -stable.
----------------------------------------------------------------
The following changes since commit 5b76c4948fe6977bead2359c2054f3e6a2dcf3d0:
netfilter: x_tables: print correct hook names for ARP (2013-01-13 12:54:12 +0100)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/horms/ipvs.git master
for you to fetch changes up to b425df4cdd953a400d814b4474c9d3ec04481858:
ipvs: freeing uninitialized pointer on error (2013-01-28 10:14:37 +0900)
----------------------------------------------------------------
Dan Carpenter (1):
ipvs: freeing uninitialized pointer on error
net/netfilter/ipvs/ip_vs_sync.c | 2 ++
1 file changed, 2 insertions(+)
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH] ipvs: freeing uninitialized pointer on error
2013-01-28 1:18 [GIT PULL nf] IPVS Simon Horman
@ 2013-01-28 1:18 ` Simon Horman
2013-02-05 2:58 ` [GIT PULL nf] IPVS Pablo Neira Ayuso
1 sibling, 0 replies; 5+ messages in thread
From: Simon Horman @ 2013-01-28 1:18 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: lvs-devel, netdev, netfilter-devel, Wensong Zhang,
Julian Anastasov, Hans Schillstrom, Hans Schillstrom,
Jesper Dangaard Brouer, Dan Carpenter, Simon Horman
From: Dan Carpenter <dan.carpenter@oracle.com>
If state != IP_VS_STATE_BACKUP then tinfo->buf is uninitialized. If
kthread_run() fails then it means we free random memory resulting in an
oops.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
---
net/netfilter/ipvs/ip_vs_sync.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index effa10c..44fd10c 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -1795,6 +1795,8 @@ int start_sync_thread(struct net *net, int state, char *mcast_ifn, __u8 syncid)
GFP_KERNEL);
if (!tinfo->buf)
goto outtinfo;
+ } else {
+ tinfo->buf = NULL;
}
tinfo->id = id;
--
1.7.10.4
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [GIT PULL nf] IPVS
2013-01-28 1:18 [GIT PULL nf] IPVS Simon Horman
2013-01-28 1:18 ` [PATCH] ipvs: freeing uninitialized pointer on error Simon Horman
@ 2013-02-05 2:58 ` Pablo Neira Ayuso
1 sibling, 0 replies; 5+ messages in thread
From: Pablo Neira Ayuso @ 2013-02-05 2:58 UTC (permalink / raw)
To: Simon Horman
Cc: lvs-devel, netdev, netfilter-devel, Wensong Zhang,
Julian Anastasov, Hans Schillstrom, Hans Schillstrom,
Jesper Dangaard Brouer, Dan Carpenter
On Mon, Jan 28, 2013 at 10:18:33AM +0900, Simon Horman wrote:
> Hi Pablo,
>
> please consider the following fix for IPVS patch for 3.8.
Pulled, thanks Simon.
> I believe that the problem was introduced in 3.4 and thus
> this fix is appropriate for 3.4, 3.5, 3.6 and 3.7 -stable.
Will pass this to -stable for 3.4 and 3.7.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2013-02-05 2:58 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-01-28 1:18 [GIT PULL nf] IPVS Simon Horman
2013-01-28 1:18 ` [PATCH] ipvs: freeing uninitialized pointer on error Simon Horman
2013-02-05 2:58 ` [GIT PULL nf] IPVS Pablo Neira Ayuso
-- strict thread matches above, loose matches on Subject: below --
2013-01-25 15:44 [patch] ipvs: freeing uninitialized pointer on error Dan Carpenter
2013-01-25 20:56 ` Julian Anastasov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).