netdev - Re: [PATCH linux-next 1/4] infiniband/ipoib: fix possible NULL pointer dereference in ipoib_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150415160623.GA4653@obsidianresearch.com>
Date:	Wed, 15 Apr 2015 10:06:23 -0600
From:	Jason Gunthorpe <jgunthorpe@...idianresearch.com>
To:	Erez Shitrit <erezsh@....mellanox.co.il>
Cc:	Honggang Li <honli@...hat.com>, Roland Dreier <roland@...nel.org>,
	sean.hefty@...el.com, hal.rosenstock@...il.com, kaber@...sh.net,
	davem@...emloft.net, Alex Estrin <alex.estrin@...el.com>,
	Doug Ledford <dledford@...hat.com>, edumazet@...gle.com,
	Erez Shitrit <erezsh@...lanox.com>, nicolas.dichtel@...nd.com,
	maheshb@...gle.com, jbenc@...hat.com, ebiederm@...ssion.com,
	elfring@...rs.sourceforge.net, f.fainelli@...il.com,
	linux@...ck-us.net, andrew@...n.ch, sfeldma@...il.com,
	alexander.h.duyck@...el.com,
	"linux-rdma@...r.kernel.org" <linux-rdma@...r.kernel.org>,
	linux-kernel@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: [PATCH linux-next 1/4] infiniband/ipoib: fix possible NULL
 pointer dereference in ipoib_get_iflink

On Wed, Apr 15, 2015 at 09:17:14AM +0300, Erez Shitrit wrote:
> >>+       /* parent interface */
> >>+       if (!test_bit(IPOIB_FLAG_SUBINTERFACE, &priv->flags))
> >>+               return dev->ifindex;
> >>+
> >>+       /* child/vlan interface */
> >>+       if (!priv->parent)
> >>+               return -1;

> >Like was said for other drivers, I can't see how parent can be null
> >while IPOIB_FLAG_SUBINTERFACE is set. Drop the last if.

> It can, at least for ipoib child interface (AKA "vlan"), you can't
> control the call for that ndo and it can be called before the parent
> was set.

If the ndo can be called before the netdev private structures are fully
prepared then we have another bug, and returning -1 or 0 is not the right
answer anyhow.

For safety, fold this into your patch.

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
index 9fad7b5ac8b9..e62b007adf5d 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
@@ -58,6 +58,7 @@ int __ipoib_vlan_add(struct ipoib_dev_priv *ppriv, struct ipoib_dev_priv *priv,
        /* MTU will be reset when mcast join happens */
        priv->dev->mtu   = IPOIB_UD_MTU(priv->max_ib_mtu);
        priv->mcast_mtu  = priv->admin_mtu = priv->dev->mtu;
+       priv->parent = ppriv->dev;
        set_bit(IPOIB_FLAG_SUBINTERFACE, &priv->flags);
 
        result = ipoib_set_dev_features(priv, ppriv->ca);
@@ -84,8 +85,6 @@ int __ipoib_vlan_add(struct ipoib_dev_priv *ppriv, struct ipoib_dev_priv *priv,
                goto register_failed;
        }
 
-       priv->parent = ppriv->dev;
-
        ipoib_create_debug_files(priv->dev);
 
        /* RTNL childs don't need proprietary sysfs entries */
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html