netdev - Re: [PATCH net-next] ipv6: check fn before doing FIB6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20171016.210634.1944938562694750278.davem@davemloft.net>
Date:   Mon, 16 Oct 2017 21:06:34 +0100 (WEST)
From:   David Miller <davem@...emloft.net>
To:     weiwan@...gle.com
Cc:     netdev@...r.kernel.org, edumazet@...gle.com, kafai@...com
Subject: Re: [PATCH net-next] ipv6: check fn before doing FIB6_SUBTREE(fn)

From: Wei Wang <weiwan@...gle.com>
Date: Fri, 13 Oct 2017 15:01:08 -0700

> From: Wei Wang <weiwan@...gle.com>
> 
> In fib6_locate(), we need to first make sure fn is not NULL before doing
> FIB6_SUBTREE(fn) to avoid crash.
> 
> This fixes the following static checker warning:
> net/ipv6/ip6_fib.c:1462 fib6_locate()
>          warn: variable dereferenced before check 'fn' (see line 1459)
> 
> net/ipv6/ip6_fib.c
>   1458          if (src_len) {
>   1459                  struct fib6_node *subtree = FIB6_SUBTREE(fn);
>                                                     ^^^^^^^^^^^^^^^^
> We shifted this dereference
> 
>   1460
>   1461                  WARN_ON(saddr == NULL);
>   1462                  if (fn && subtree)
>                             ^^
> before the check for NULL.
> 
>   1463                          fn = fib6_locate_1(subtree, saddr, src_len,
>   1464                                             offsetof(struct rt6_info, rt6i_src)
> 
> Fixes: 66f5d6ce53e6 ("ipv6: replace rwlock with rcu and spinlock in fib6_table")
> Reported-by: Dan Carpenter <dan.carpenter@...cle.com>
> Signed-off-by: Wei Wang <weiwan@...gle.com>
> Acked-by: Eric Dumazet <edumazet@...gle.com>

Applied.