linux-kernel - Re: [PATCH] net: dl2k: fix potential null deref in receive

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Z92zGMsCPHCIbx62@qasdev.system>
Date: Fri, 21 Mar 2025 18:42:32 +0000
From: Qasim Ijaz <qasdev00@...il.com>
To: Eric Dumazet <edumazet@...gle.com>
Cc: andrew+netdev@...n.ch, davem@...emloft.net, kuba@...nel.org,
	pabeni@...hat.com, yyyynoom@...il.com, horms@...nel.org,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] net: dl2k: fix potential null deref in receive_packet()

On Fri, Mar 21, 2025 at 04:13:04PM +0100, Eric Dumazet wrote:
> On Fri, Mar 21, 2025 at 1:15 PM Qasim Ijaz <qasdev00@...il.com> wrote:
> >
> > If the pkt_len is less than the copy_thresh the netdev_alloc_skb_ip_align()
> > is called to allocate an skbuff, on failure it can return NULL. Since
> > there is no NULL check a NULL deref can occur when setting
> > skb->protocol.
> >
> > Fix this by introducing a NULL check to handle allocation failure.
> >
> > Fixes: 89d71a66c40d ("net: Use netdev_alloc_skb_ip_align()")
> 
> This commit has not changed the behavior in case of memory alloc error.
> 

Hi Eric,

Thanks for pointing this out, I referenced this commit because it 
added the netdev_alloc_skb_ip_align() call without ensuring the 
result of it succeeds or not. Before this change the code used 
netdev_alloc_skb(), so I now see that there is no functional
difference since an allocation occurs in both versions.

> > Signed-off-by: Qasim Ijaz <qasdev00@...il.com>
> > ---
> >  drivers/net/ethernet/dlink/dl2k.c | 5 +++++
> >  1 file changed, 5 insertions(+)
> >
> > diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
> > index d0ea92607870..22e9432adea0 100644
> > --- a/drivers/net/ethernet/dlink/dl2k.c
> > +++ b/drivers/net/ethernet/dlink/dl2k.c
> > @@ -968,6 +968,11 @@ receive_packet (struct net_device *dev)
> >                                                            np->rx_buf_sz,
> >                                                            DMA_FROM_DEVICE);
> >                         }
> > +
> > +                       if (unlikely(!skb)) {
> > +                               np->rx_ring[entry].fraginfo = 0;
> 
> Not sure how this was tested...
> 
> I think this would leak memory.

Could you please elaborate on where you think this may arise so I can
investigate further and try to amend it?

Thanks
Qasim
> 
> > +                               break;
> > +                       }
> >                         skb->protocol = eth_type_trans (skb, dev);
> >  #if 0
> >                         /* Checksum done by hw, but csum value unavailable. */
> > --
> > 2.39.5