netdev - Re: [PATCH] net: ipv4: Potential null pointer dereference in cipso_v4_parsetag

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <69cc98e9-0110-4e0d-97a2-b874f876f8d8@linux.dev>
Date: Mon, 8 Sep 2025 11:09:02 +0100
From: Vadim Fedorenko <vadim.fedorenko@...ux.dev>
To: Chen Yufeng <chenyufeng@....ac.cn>, paul@...l-moore.com
Cc: davem@...emloft.net, dsahern@...nel.org, netdev@...r.kernel.org
Subject: Re: [PATCH] net: ipv4: Potential null pointer dereference in
 cipso_v4_parsetag_enum

On 08/09/2025 09:03, Chen Yufeng wrote:
> While parsing CIPSO enumerated tags, secattr->flags is set to
> NETLBL_SECATTR_MLS_CAT even if secattr->attr.mls.cat is NULL.
> If subsequent code attempts to access secattr->attr.mls.cat,
> it may lead to a null pointer dereference, causing a system crash.
> 
> To address this issue, we add a check to ensure that before setting
> the NETLBL_SECATTR_MLS_CAT flag, secattr->attr.mls.cat is not NULL.
> 
> fixed code:
> ```
> if (secattr->attr.mls.cat)
>      secattr->flags |= NETLBL_SECATTR_MLS_CAT;
> ```
> 
> This patch is similar to eead1c2ea250("netlabel: cope with NULL catmap").
> 
> Signed-off-by: Chen Yufeng <chenyufeng@....ac.cn>
> ---
>   net/ipv4/cipso_ipv4.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
> index 740af8541d2f..2190333d78cb 100644
> --- a/net/ipv4/cipso_ipv4.c
> +++ b/net/ipv4/cipso_ipv4.c
> @@ -1339,8 +1339,8 @@ static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
>   			netlbl_catmap_free(secattr->attr.mls.cat);
>   			return ret_val;
>   		}
> -
> -		secattr->flags |= NETLBL_SECATTR_MLS_CAT;
> +		if (secattr->attr.mls.cat)
> +			secattr->flags |= NETLBL_SECATTR_MLS_CAT;
>   	}
>   
>   	return 0;

Reviewed-by: Vadim Fedorenko <vadim.fedorenko@...ux.dev>