netdev - RE: [PATCH net] vsock: cope with memory allocation failure at socket creation time

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <MWHPR05MB337627F0B322295C437DDAFADA680@MWHPR05MB3376.namprd05.prod.outlook.com>
Date:   Thu, 7 Feb 2019 14:00:19 +0000
From:   "Jorgen S. Hansen" <jhansen@...are.com>
To:     'Paolo Abeni' <pabeni@...hat.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
CC:     "David S. Miller" <davem@...emloft.net>,
        Stefano Garzarella <sgarzare@...hat.com>
Subject: RE: [PATCH net] vsock: cope with memory allocation failure at socket
 creation time

> In the unlikely event that the kmalloc call in vmci_transport_socket_init()
> fails, we end-up calling vmci_transport_destruct() with a NULL vmci_trans()
> and oopsing.
> 
> This change addresses the above explicitly checking for zero vmci_trans() at
> destruction time.
> 
> Reported-by: Xiumei Mu <xmu@...hat.com>
> Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
> Signed-off-by: Paolo Abeni <pabeni@...hat.com>
> ---
>  net/vmw_vsock/vmci_transport.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/net/vmw_vsock/vmci_transport.c
> b/net/vmw_vsock/vmci_transport.c index c361ce782412..c3d5ab01fba7
> 100644
> --- a/net/vmw_vsock/vmci_transport.c
> +++ b/net/vmw_vsock/vmci_transport.c
> @@ -1651,6 +1651,10 @@ static void vmci_transport_cleanup(struct
> work_struct *work)
> 
>  static void vmci_transport_destruct(struct vsock_sock *vsk)  {
> +	/* transport can be NULL if we hit a failure at init() time */
> +	if (!vmci_trans(vsk))
> +		return;
> +
>  	/* Ensure that the detach callback doesn't use the sk/vsk
>  	 * we are about to destruct.
>  	 */
> --
> 2.20.1

Reviewed-by: Jorgen Hansen <jhansen@...are.com>

Thanks for fixing this,
Jorgen