netdev - Re: [PATCH 1/1] NET: netpoll, fix potential NULL ptr dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4BA23EFA.9040906@gmail.com>
Date:	Thu, 18 Mar 2010 15:55:54 +0100
From:	Daniel Borkmann <danborkmann@...glemail.com>
To:	Matt Mackall <mpm@...enic.com>
CC:	Jiri Slaby <jirislaby@...il.com>, Jiri Slaby <jslaby@...e.cz>,
	davem@...emloft.net, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Daniel Borkmann <danborkmann@...glemail.com>
Subject: Re: [PATCH 1/1] NET: netpoll, fix potential NULL ptr dereference

Matt Mackall wrote:
> On Tue, 2010-03-16 at 18:22 +0100, Jiri Slaby wrote:
>> On 03/16/2010 06:12 PM, Matt Mackall wrote:
>>> I don't get it. The source of the branch tests for !ndev->npinfo and the
>>> original destination of the branch also tests for !ndev->npinfo. I don't
>>> see how it gets dereferenced.
>> Let's look at more of the context:
>>          if (!ndev->npinfo) {
>>                  npinfo = kmalloc(sizeof(*npinfo), GFP_KERNEL);
>>                  if (!npinfo) {         // npinfo is NULL
>>                          err = -ENOMEM;
>>                          goto release;
>>                  }
>> ...
>> release:                           // npinfo is still NULL
>>          if (!ndev->npinfo) {       // condition is the same (holds)
>>               // dereference below: vvvvvvvvvvvvvvv
>>                  spin_lock_irqsave(&npinfo->rx_lock, flags);
>>                  list_for_each_entry_safe(npe, tmp, &npinfo->rx_np, rx) {
>>                          npe->dev = NULL;
>>                  }
>>                  spin_unlock_irqrestore(&npinfo->rx_lock, flags);
>>
>>                  kfree(npinfo);
>>          }
> 
> Ok, you're correct, I read the second test backwards.
> 
> Acked-by: Matt Mackall <mpm@...enic.com>
> 

Thanks for fixing this and sorry for not being responsive, obviously it
sucks when you have a broken leg and German hospitals do not really have
Internet access ... ;)

Thanks,
Daniel


Download attachment "signature.asc" of type "application/pgp-signature" (262 bytes)