netdev - igmp: possible NULL dereference after GFP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070130105701.GA6015@localhost.sw.ru>
Date:	Tue, 30 Jan 2007 13:57:01 +0300
From:	Alexey Dobriyan <adobriyan@...nvz.org>
To:	netdev@...r.kernel.org
Cc:	kuznet@....inr.ac.ru, dlstevens@...ibm.com, davem@...emloft.net
Subject: igmp: possible NULL dereference after GFP_ATOMIC allocation?

igmpv3_newpack() uses alloc_skb() with GFP_ATOMIC.
It fails, igmpv3_newpack() returns NULL.
add_grhead(), sees NULL,  returns NULL.

At one place add_grhead() return value fed into skb_put() which
dereferences it.

net/ipv4/igmp.c:
   454			if (first) {
   455				skb = add_grhead(skb, pmc, type, &pgr);
   456				first = 0;
   457			}
   458			psrc = (u32 *)skb_put(skb, sizeof(u32));

-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html