linux-kernel - Re: [PATCH] cxgb4: cm: fix a incorrect NULL check on list iterator

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 27 Mar 2022 19:38:31 +0300
From:   Leon Romanovsky <leon@...nel.org>
To:     Xiaomeng Tong <xiam0nd.tong@...il.com>
Cc:     bharat@...lsio.com, jgg@...pe.ca, vipul@...lsio.com,
        roland@...estorage.com, linux-rdma@...r.kernel.org,
        linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH] cxgb4: cm: fix a incorrect NULL check on list iterator

On Sun, Mar 27, 2022 at 03:35:42PM +0800, Xiaomeng Tong wrote:
> The bug is here:
> 	if (!pdev) {
> 
> The list iterator value 'pdev' will *always* be set and non-NULL
> by for_each_netdev(), so it is incorrect to assume that the
> iterator value will be NULL if the list is empty or no element
> found (in this case, the check 'if (!pdev)' can be bypassed as
> it always be false unexpectly).
> 
> To fix the bug, use a new variable 'iter' as the list iterator,
> while use the original variable 'pdev' as a dedicated pointer to
> point to the found element.

I don't think that the description is correct.
We are talking about loopback interface which received packet, the pdev will always exist.
Most likely. the check of "if (!pdev)" is to catch impossible situation where IPV6 packet
was sent over loopback, but IPV6 is not enabled.

Thanks

> 
> Cc: stable@...r.kernel.org
> Fixes: 830662f6f032f ("RDMA/cxgb4: Add support for active and passive open connection with IPv6 address")
> Signed-off-by: Xiaomeng Tong <xiam0nd.tong@...il.com>
> ---
>  drivers/infiniband/hw/cxgb4/cm.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
> index c16017f6e8db..870d8517310b 100644
> --- a/drivers/infiniband/hw/cxgb4/cm.c
> +++ b/drivers/infiniband/hw/cxgb4/cm.c
> @@ -2071,7 +2071,7 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip,
>  {
>  	struct neighbour *n;
>  	int err, step;
> -	struct net_device *pdev;
> +	struct net_device *pdev = NULL, *iter;
>  
>  	n = dst_neigh_lookup(dst, peer_ip);
>  	if (!n)
> @@ -2083,14 +2083,14 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip,
>  		if (iptype == 4)
>  			pdev = ip_dev_find(&init_net, *(__be32 *)peer_ip);
>  		else if (IS_ENABLED(CONFIG_IPV6))
> -			for_each_netdev(&init_net, pdev) {
> +			for_each_netdev(&init_net, iter) {
>  				if (ipv6_chk_addr(&init_net,
>  						  (struct in6_addr *)peer_ip,
> -						  pdev, 1))
> +						  iter, 1)) {
> +					pdev = iter;
>  					break;
> +				}
>  			}
> -		else
> -			pdev = NULL;
>  
>  		if (!pdev) {
>  			err = -ENODEV;
> -- 
> 2.17.1
>