netdev - Re: [PATCH] qede: fix null pointer dereference on skb on allocation failure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 01 Aug 2018 12:03:17 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     colin.king@...onical.com
Cc:     Ariel.Elior@...ium.com, everest-linux-l2@...ium.com,
        netdev@...r.kernel.org, kernel-janitors@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] qede: fix null pointer dereference on skb on
 allocation failure

From: Colin King <colin.king@...onical.com>
Date: Wed,  1 Aug 2018 17:39:47 +0100

> From: Colin Ian King <colin.king@...onical.com>
> 
> If skb fails to be allocated with the call to build_skb then a
> null pointer dereference will occur on the call to skb_reserve.
> Fix this by checking for a null skb and returning NULL.
> 
> Detected by CoverityScan, CID#1469485 ("Dereference null return value")
> 
> Fixes: 8a8633978b84 ("qede: Add build_skb() support.")
> Signed-off-by: Colin Ian King <colin.king@...onical.com>

This is in no way sufficient.

The caller doesn't check the return value, so you're just pushing
the problem one function level up.

In fact, the caller is going to take a reference on the page
whether this returns NULL or not, thus leaking that memory.

The whole call chain needs to be fixed to handle build_skb()
errors, not just this one function.

Thanks.