lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 27 May 2015 06:28:19 +0000 (UTC) From: Jeremy <poseng@...il.com> To: netdev@...r.kernel.org Subject: IPv6: finding a match in find_rr_leaf that cause a NULL pointer dereference Hi all, My kernel is 3.10.20 and I encountered this NULL pointer dereference. According to my log, I found that dev is NULL in the beginning of for loop. it is the dev of rr_head that has been set to NULL. That might be possible that dev being NULL but I don't see any case to avoid such case in rt6_check_dev(), even the kernel 4.0. Don't know if my concern is necessary or not or there has a mechanism in somewhere that I hadn't been noticed. Any comment of my concern is welcome and thanks for your time to review my post. for (rt = rr_head; rt && rt->rt6i_metric == metric; rt = rt->dst.rt6_next) match = find_match(rt, oif, strict, &mpri, match, do_rr); --> rt6_score_route(rt, oif, strict); --> rt6_check_dev(rt, oif); --> struct net_device *dev = rt->dst.dev; --> if (!oif || dev->ifindex == oif) <------NULL pointer dereference on dev object. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists