Bug 195495
| Summary: | unchecked return value of nla_nest_start() in function lwtunnel_fill_encap() | ||
|---|---|---|---|
| Product: | Networking | Reporter: | bianpan (bianpan2010) |
| Component: | Other | Assignee: | Stephen Hemminger (stephen) |
| Status: | RESOLVED CODE_FIX | ||
| Severity: | normal | ||
| Priority: | P1 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Kernel Version: | linux-4.11-rc7 | Subsystem: | |
| Regression: | No | Bisected commit-id: | |
| Attachments: | The patch fixes the bug | ||
Created attachment 256467 [details]
The patch fixes the bug
The patch has been merged into the latest version of the Linux kernel. So I will close the bug.
|
Function nla_nest_start() may return a NULL pointer on error. However, in function lwtunnel_fill_encap(), the return value of nla_nest_start() is not checked against NULL (see line 218), and may result in bad memory access. Related code snippets are shown as follows. lwtunnel_fill_encap @@ net/core/lwtunnel.c: 204 204 int lwtunnel_fill_encap(struct sk_buff *skb, struct lwtunnel_state *lwtstate) 205 { 206 const struct lwtunnel_encap_ops *ops; 207 struct nlattr *nest; 208 int ret = -EINVAL; 209 210 if (!lwtstate) 211 return 0; 212 213 if (lwtstate->type == LWTUNNEL_ENCAP_NONE || 214 lwtstate->type > LWTUNNEL_ENCAP_MAX) 215 return 0; 216 217 ret = -EOPNOTSUPP; 218 nest = nla_nest_start(skb, RTA_ENCAP); 219 rcu_read_lock(); 220 ops = rcu_dereference(lwtun_encaps[lwtstate->type]); 221 if (likely(ops && ops->fill_encap)) 222 ret = ops->fill_encap(skb, lwtstate); 223 rcu_read_unlock(); 224 225 if (ret) 226 goto nla_put_failure; 227 nla_nest_end(skb, nest); 228 ret = nla_put_u16(skb, RTA_ENCAP_TYPE, lwtstate->type); 229 if (ret) 230 goto nla_put_failure; 231 232 return 0; 233 234 nla_put_failure: 235 nla_nest_cancel(skb, nest); 236 237 return (ret == -EOPNOTSUPP ? 0 : ret); 238 } Generally, the return value of function nla_nest_start() should be checked against NULL, as follows. rtnetlink_put_metrics @@ net/core/rtnetlink.c: 686 int rtnetlink_put_metrics(struct sk_buff *skb, u32 *metrics) 687 { 688 struct nlattr *mx; 689 int i, valid = 0; 690 691 mx = nla_nest_start(skb, RTA_METRICS); 692 if (mx == NULL) 693 return -ENOBUFS; ... 726 return nla_nest_end(skb, mx); 727 728 nla_put_failure: 729 nla_nest_cancel(skb, mx); 730 return -EMSGSIZE; 731 } Thanks very much for your attention! Pan Bian