linux-kernel - Re: [PATCH] Fix null pointer dereference in vector_user

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <39158d22-9997-32ef-c599-7e6a98988a38@cambridgegreys.com>
Date:   Sun, 14 Jun 2020 07:38:51 +0100
From:   Anton Ivanov <anton.ivanov@...bridgegreys.com>
To:     Gaurav Singh <gaurav1086@...il.com>, Jeff Dike <jdike@...toit.com>,
        Richard Weinberger <richard@....at>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        Andrii Nakryiko <andriin@...com>,
        John Fastabend <john.fastabend@...il.com>,
        KP Singh <kpsingh@...omium.org>,
        Alex Dewar <alex.dewar@....co.uk>,
        Marc-André Lureau <marcandre.lureau@...hat.com>,
        "open list:USER-MODE LINUX (UML)" <linux-um@...ts.infradead.org>,
        open list <linux-kernel@...r.kernel.org>,
        "open list:BPF (Safe dynamic programs and tools)" 
        <netdev@...r.kernel.org>,
        "open list:BPF (Safe dynamic programs and tools)" 
        <bpf@...r.kernel.org>
Subject: Re: [PATCH] Fix null pointer dereference in vector_user_bpf

On 14/06/2020 02:19, Gaurav Singh wrote:
> The bpf_prog is being checked for !NULL after uml_kmalloc
> but later its used directly for example:
> bpf_prog->filter = bpf and is also later returned upon
> success. Fix this, do a NULL check and return right away.
> 
> Signed-off-by: Gaurav Singh <gaurav1086@...il.com>
> ---
>   arch/um/drivers/vector_user.c | 8 +++++---
>   1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/um/drivers/vector_user.c b/arch/um/drivers/vector_user.c
> index c4a0f26b2824..0e6d6717bf73 100644
> --- a/arch/um/drivers/vector_user.c
> +++ b/arch/um/drivers/vector_user.c
> @@ -789,10 +789,12 @@ void *uml_vector_user_bpf(char *filename)
>   		return false;
>   	}
>   	bpf_prog = uml_kmalloc(sizeof(struct sock_fprog), UM_GFP_KERNEL);
> -	if (bpf_prog != NULL) {
> -		bpf_prog->len = statbuf.st_size / sizeof(struct sock_filter);
> -		bpf_prog->filter = NULL;
> +	if (bpf_prog == NULL) {
> +		printk(KERN_ERR "Failed to allocate bpf prog buffer");
> +		return NULL;
>   	}
> +	bpf_prog->len = statbuf.st_size / sizeof(struct sock_filter);
> +	bpf_prog->filter = NULL;
>   	ffd = os_open_file(filename, of_read(OPENFLAGS()), 0);
>   	if (ffd < 0) {
>   		printk(KERN_ERR "Error %d opening bpf file", -errno);
> 

Acked-By: Anton Ivanov <anton.ivanov@...bridgegreys.com>
-- 
Anton R. Ivanov
Cambridgegreys Limited. Registered in England. Company Number 10273661
https://www.cambridgegreys.com/