netdev - Re: Fix NULL dereference in x25

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 02 Nov 2011 03:10:45 +0100
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Dave Jones <davej@...hat.com>
Cc:	netdev@...r.kernel.org, Matthew Daley <mattjd@...il.com>
Subject: Re: Fix NULL dereference in x25_recvmsg

Le mardi 01 novembre 2011 à 21:53 -0400, Dave Jones a écrit :
> commit cb101ed2 in 3.0 introduced a bug in x25_recvmsg()
> When passed bogus junk from userspace, x25->neighbour can be NULL,
> as shown in this oops..
> 

Your patch seems fine but :

Are you sure this bug is not present on previous kernels ?

It seems we had prior to this commit :

skb_pull(skb, x25->neighbour->extended ?
	X25_EXT_MIN_LEN : X25_STD_MIN_LEN);



> Signed-off-by: Dave Jones <davej@...hat.com>
> 
> diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
> index 5f03e4e..291b2e0 100644
> --- a/net/x25/af_x25.c
> +++ b/net/x25/af_x25.c
> @@ -1261,13 +1261,17 @@ static int x25_recvmsg(struct kiocb *iocb, struct socket *sock,
>  	struct x25_sock *x25 = x25_sk(sk);
>  	struct sockaddr_x25 *sx25 = (struct sockaddr_x25 *)msg->msg_name;
>  	size_t copied;
> -	int qbit, header_len = x25->neighbour->extended ?
> -		X25_EXT_MIN_LEN : X25_STD_MIN_LEN;
> -
> +	int qbit, header_len;
>  	struct sk_buff *skb;
>  	unsigned char *asmptr;
>  	int rc = -ENOTCONN;
>  
> +	if (x25->neighbour == NULL)
> +		return rc;
> +
> +	header_len = x25->neighbour->extended ?
> +		X25_EXT_MIN_LEN : X25_STD_MIN_LEN;
> +
>  	lock_sock(sk);



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html