netdev - Re: [PATCH net] net: bonding: fix possible NULL deref in rlb code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 27 Jun 2022 10:30:11 -0700
From:   Jay Vosburgh <jay.vosburgh@...onical.com>
To:     Eric Dumazet <edumazet@...gle.com>
cc:     "David S . Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>, netdev@...r.kernel.org,
        eric.dumazet@...il.com, syzbot <syzkaller@...glegroups.com>,
        Veaceslav Falico <vfalico@...il.com>,
        Andy Gospodarek <andy@...yhouse.net>
Subject: Re: [PATCH net] net: bonding: fix possible NULL deref in rlb code

Eric Dumazet <edumazet@...gle.com> wrote:

>syzbot has two reports involving the same root cause.
>
>bond_alb_initialize() must not set bond->alb_info.rlb_enabled
>if a memory allocation error is detected.
>
[...]
>
>Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
>Reported-by: syzbot <syzkaller@...glegroups.com>
>Signed-off-by: Eric Dumazet <edumazet@...gle.com>
>Cc: Jay Vosburgh <j.vosburgh@...il.com>
>Cc: Veaceslav Falico <vfalico@...il.com>
>Cc: Andy Gospodarek <andy@...yhouse.net>

Acked-by: Jay Vosburgh <jay.vosburgh@...onical.com>


>---
> drivers/net/bonding/bond_alb.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
>index 303c8d32d451e24345222ec105a1986d53a94eb4..007d43e46dcb0cb1cee1f23623bd161a6c32a45c 100644
>--- a/drivers/net/bonding/bond_alb.c
>+++ b/drivers/net/bonding/bond_alb.c
>@@ -1302,12 +1302,12 @@ int bond_alb_initialize(struct bonding *bond, int rlb_enabled)
> 		return res;
> 
> 	if (rlb_enabled) {
>-		bond->alb_info.rlb_enabled = 1;
> 		res = rlb_initialize(bond);
> 		if (res) {
> 			tlb_deinitialize(bond);
> 			return res;
> 		}
>+		bond->alb_info.rlb_enabled = 1;
> 	} else {
> 		bond->alb_info.rlb_enabled = 0;
> 	}
>-- 
>2.37.0.rc0.161.g10f37bed90-goog
>