netdev - Re: igmp: possible NULL dereference after GFP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 30 Jan 2007 18:04:27 +0300
From:	Alexey Dobriyan <adobriyan@...nvz.org>
To:	David Stevens <dlstevens@...ibm.com>
Cc:	davem@...emloft.net, kuznet@....inr.ac.ru, netdev@...r.kernel.org,
	netdev-owner@...r.kernel.org
Subject: Re: igmp: possible NULL dereference after GFP_ATOMIC allocation?

On Tue, Jan 30, 2007 at 03:34:18AM -0800, David Stevens wrote:
>         I think you're correct-- looks like it needs:
>
>         if (!skb)
>                 return NULL;
>
> just before the skb_put(), since an allocation (and failure)
> could occur in either the igmpv3_newpack() call or in add_grhead().
>         Also, similar code in net/ipv6/mcast..c.
>
>         Will you be submitting the patch?

One box here can semi-reliably reproduce oops which is attributed to
these allocation failures. I'll tell if patch works or not soon.

BUG: unable to handle kernel NULL pointer dereference at virtual address 00000064
 EIP is at add_grec+0x22b/0x372
 eax: 00000000   ebx: 00000000   ecx: f567cb20   edx: f567cb20
 esi: e91ad540   edi: 00000001   ebp: 00000000   esp: c0787f54
 ds: 007b   es: 007b   ss: 0068
 Process swapper (pid: 0, veid: 0, ti=c0787000 task=c0670be0 task.ti=c073e000)
 Stack: c0787f80 00000001 00000005 e08a8920 c930a800 00000000 e08a892c 00000000
        00000000 00000000 00000000 00000000 e08a8920 e2000ea0 00000000 00000005
        c05f1510 00000000 00000001 00000000 c0678580 c07fbb00 00000100 c05f13ac
 Call Trace:
  [<c05f1510>] igmp_ifc_timer_expire+0x164/0x1db
  [<c042cd17>] run_timer_softirq+0x116/0x18d
  [<c0427ea8>] __do_softirq+0x84/0x109
  [<c0406234>] do_softirq+0x55/0xad
  =======================
 Code: fa ff ff 89 c3 c7 44 24 1c 00 00 00 00 eb 04 85 ff 74 18 8b 4c 24 08 8d 44 24 2c 8b 54 24 0c 89 04 24 89 d8 e8 66 fc ff ff 89 c3 <83> 7b 64 00 8b bb a0 00 00 00 74 0b 0f 0b 66 b8 5a 03 b8 52 e9
 EIP: [<c05f1265>] add_grec+0x22b/0x372 SS:ESP 0068:c0787f54
 Kernel panic - not syncing: Fatal exception in interrupt

-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html