netdev - [PATCH net-next] xfrm: check function pointer of xfrm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 10 Nov 2013 22:25:56 +0800
From:	baker.kernel@...il.com
To:	herbert@...dor.apana.org.au, davem@...emloft.net,
	steffen.klassert@...unet.com
Cc:	netdev@...r.kernel.org, "baker.zhang" <baker.kernel@...il.com>
Subject: [PATCH net-next] xfrm: check function pointer of xfrm_mgr before use it

From: "baker.zhang" <baker.kernel@...il.com>

Signed-off-by: baker.zhang <baker.kernel@...il.com>
---
For current kernel source, there is no problem.

In our vpn product, we need a xfrm_km in kernel module
to monitor the xfrm state change.
thus, the 'acquire' and 'compile_policy' may be NULL.

So I think we should do the check before use it.

 net/xfrm/xfrm_state.c | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index b9c3f9e..541f684 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1679,9 +1679,11 @@ int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
 
 	rcu_read_lock();
 	list_for_each_entry_rcu(km, &xfrm_km_list, list) {
-		acqret = km->acquire(x, t, pol);
-		if (!acqret)
-			err = acqret;
+		if (km->acquire) {
+			acqret = km->acquire(x, t, pol);
+			if (!acqret)
+				err = acqret;
+		}
 	}
 	rcu_read_unlock();
 	return err;
@@ -1783,10 +1785,12 @@ int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen
 	err = -EINVAL;
 	rcu_read_lock();
 	list_for_each_entry_rcu(km, &xfrm_km_list, list) {
-		pol = km->compile_policy(sk, optname, data,
-					 optlen, &err);
-		if (err >= 0)
-			break;
+		if (km->compile_policy) {
+			pol = km->compile_policy(sk, optname, data,
+					optlen, &err);
+			if (err >= 0)
+				break;
+		}
 	}
 	rcu_read_unlock();
 
-- 
1.8.3.2

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html