linux-kernel - re: RDMA/rxe: Fix skb lifetime in rxe_rcv_mcast

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <9ca5205a-ee1c-0ad6-3e9d-3287e92714a1@canonical.com>
Date:   Mon, 12 Oct 2020 16:32:20 +0100
From:   Colin Ian King <colin.king@...onical.com>
To:     Bob Pearson <rpearsonhpe@...il.com>
Cc:     Zhu Yanjun <yanjunz@...dia.com>,
        "Doug Ledford <dledford"@redhat.com,
        Jason Gunthorpe <jgg@...pe.ca>, linux-rdma@...r.kernel.org,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: re: RDMA/rxe: Fix skb lifetime in rxe_rcv_mcast_pkt()

Hi,

Static analysis with Coverity has detected a potential issue with the
following commit:

commit e7ec96fc7932f48a6d6cdd05bf82004a1a04285b
Author: Bob Pearson <rpearsonhpe@...il.com>
Date:   Thu Oct 8 15:36:52 2020 -0500

    RDMA/rxe: Fix skb lifetime in rxe_rcv_mcast_pkt()

The analysis is as follows:

   16. Condition mce->qp_list.next != &mcg->qp_list, taking true branch.

269                if (mce->qp_list.next != &mcg->qp_list)

   17. returned_null: skb_clone returns NULL (checked 153 out of 178 times).
   18. var_assigned: Assigning: per_qp_skb = NULL return value from
skb_clone.
   19. Falling through to end of if statement.
270                        per_qp_skb = skb_clone(skb, GFP_ATOMIC);
271                else
272                        per_qp_skb = skb;
273
274                per_qp_pkt = SKB_TO_PKT(per_qp_skb);
275                per_qp_pkt->qp = qp;
276                rxe_add_ref(qp);

Dereference null return value (NULL_RETURNS)
    20. dereference: Dereferencing a pointer that might be NULL
per_qp_skb when calling rxe_rcv_pkt.
277                rxe_rcv_pkt(per_qp_pkt, per_qp_skb);
278        }
279

It is possible for skb_clone to return NULL, so dereferencing the NULL
return pointer per_qp_skb is a potential issue.

Colin