netdev - Re: [PATCH net] ipv6: route: Fix return value of ip6_neigh_lookup() on neigh

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20190102.103058.233954568393750158.davem@davemloft.net>
Date:   Wed, 02 Jan 2019 10:30:58 -0800 (PST)
From:   David Miller <davem@...emloft.net>
To:     sbrivio@...hat.com
Cc:     jishi@...hat.com, dsahern@...il.com, netdev@...r.kernel.org
Subject: Re: [PATCH net] ipv6: route: Fix return value of
 ip6_neigh_lookup() on neigh_create() error

From: Stefano Brivio <sbrivio@...hat.com>
Date: Wed,  2 Jan 2019 13:29:27 +0100

> In ip6_neigh_lookup(), we must not return errors coming from
> neigh_create(): if creation of a neighbour entry fails, the lookup should
> return NULL, in the same way as it's done in __neigh_lookup().
> 
> Otherwise, callers legitimately checking for a non-NULL return value of
> the lookup function might dereference an invalid pointer.
> 
> For instance, on neighbour table overflow, ndisc_router_discovery()
> crashes ndisc_update() by passing ERR_PTR(-ENOBUFS) as 'neigh' argument.
> 
> Reported-by: Jianlin Shi <jishi@...hat.com>
> Fixes: f8a1b43b709d ("net/ipv6: Create a neigh_lookup for FIB entries")
> Signed-off-by: Stefano Brivio <sbrivio@...hat.com>

Applied and queued up for -stable, thank you.