netdev - Re: [PATCH net 1/2] net_sched: fix NULL pointer dereference when delete tcindex filter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAM_iQpXikpm9BYBBtEOAYTSxn1AqCaEBb3sfJyWyA1kA+ybMww@mail.gmail.com>
Date:   Mon, 13 Aug 2018 18:46:05 -0700
From:   Cong Wang <xiyou.wangcong@...il.com>
To:     Hangbin Liu <liuhangbin@...il.com>
Cc:     Linux Kernel Network Developers <netdev@...r.kernel.org>,
        David Miller <davem@...emloft.net>
Subject: Re: [PATCH net 1/2] net_sched: fix NULL pointer dereference when
 delete tcindex filter

On Mon, Aug 13, 2018 at 3:44 AM Hangbin Liu <liuhangbin@...il.com> wrote:
>
> This is because in tcindex_set_parms, when there is no old_r, we set new
> exts to cr.exts. And we didn't set it to filter when r == &new_filter_result.
>
> Then in tcindex_delete() -> tcf_exts_get_net(), we will get NULL pointer
> dereference as we didn't init exts.
>
> Fix it by moving tcf_exts_change() after "if (old_r && old_r != r)" check.
> Then we don't need "cr" as there is no errout after that.

Acked-by: Cong Wang <xiyou.wangcong@...il.com>