Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1680423

[PATCH 3.18 28/36] xfrm: NULL dereference on allocation failure

Show all headers | View raw

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <dan.carpenter@oracle.com>

commit e747f64336fc15e1c823344942923195b800aa1e upstream.

The default error code in pfkey_msg2xfrm_state() is -ENOBUFS.  We
added a new call to security_xfrm_state_alloc() which sets "err" to zero
so there several places where we can return ERR_PTR(0) if kmalloc()
fails.  The caller is expecting error pointers so it leads to a NULL
dereference.

Fixes: df71837d5024 ("[LSM-IPSec]: Security association restriction.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/key/af_key.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1135,6 +1135,7 @@ static struct xfrm_state * pfkey_msg2xfr
 			goto out;
 	}
 
+	err = -ENOBUFS;
 	key = ext_hdrs[SADB_EXT_KEY_AUTH - 1];
 	if (sa->sadb_sa_auth) {
 		int keysize = 0;

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.18 00/36] 3.18.60-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:40 +0200
  [PATCH 3.18 15/36] arm64: cpuinfo: Missing NULL terminator in compat_hwcap_str Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:40 +0200
  [PATCH 3.18 34/36] cpufreq: s3c2416: double free on driver init error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:40 +0200
  [PATCH 3.18 18/36] MIPS: Fix IRQ tracing & lockdep when rescheduling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:40 +0200
  [PATCH 3.18 25/36] net: korina: Fix NAPI versus resources freeing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:40 +0200
  Re: [PATCH 3.18 14/36] NFSv4: fix a reference leak caused WARNING  messages Trond Myklebust <trondmy@primarydata.com> - 2017-07-03 16:40 +0200
    Re: [PATCH 3.18 14/36] NFSv4: fix a reference leak caused WARNING  messages "gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
  [PATCH 3.18 28/36] xfrm: NULL dereference on allocation failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 31/36] ARM: 8685/1: ensure memblock-limit is pmd-aligned Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 11/36] ipv6: fix calling in6_ifa_hold incorrectly for dad work Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 32/36] iommu/vt-d: Dont over-free page table directories Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 06/36] decnet: dn_rtmsg: Improve input length sanitization in dnrmg_receive_user_skb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 27/36] xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 05/36] net: dont call strlen on non-terminated string in dev_set_alias() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 29/36] xfrm: Oops on error in pfkey_msg2xfrm_state() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 07/36] Fix an intermittent pr_emerg warning about lo becoming free. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 20/36] drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 16/36] MIPS: Avoid accidental raw backtrace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 14/36] NFSv4: fix a reference leak caused WARNING messages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 08/36] net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 30/36] watchdog: bcm281xx: Fix use of uninitialized spinlock. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 17/36] MIPS: pm-cps: Drop manual cache-line alignment of ready_count Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  Re: [PATCH 3.18 00/36] 3.18.60-stable review Guenter Roeck <linux@roeck-us.net> - 2017-07-03 21:40 +0200

csiph-web