Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1680435

[PATCH 3.18 29/36] xfrm: Oops on error in pfkey_msg2xfrm_state()

Show all headers | View raw

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 1e3d0c2c70cd3edb5deed186c5f5c75f2b84a633 upstream.

There are some missing error codes here so we accidentally return NULL
instead of an error pointer.  It results in a NULL pointer dereference.

Fixes: df71837d5024 ("[LSM-IPSec]: Security association restriction.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/key/af_key.c |   16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1147,8 +1147,10 @@ static struct xfrm_state * pfkey_msg2xfr
 		if (key)
 			keysize = (key->sadb_key_bits + 7) / 8;
 		x->aalg = kmalloc(sizeof(*x->aalg) + keysize, GFP_KERNEL);
-		if (!x->aalg)
+		if (!x->aalg) {
+			err = -ENOMEM;
 			goto out;
+		}
 		strcpy(x->aalg->alg_name, a->name);
 		x->aalg->alg_key_len = 0;
 		if (key) {
@@ -1167,8 +1169,10 @@ static struct xfrm_state * pfkey_msg2xfr
 				goto out;
 			}
 			x->calg = kmalloc(sizeof(*x->calg), GFP_KERNEL);
-			if (!x->calg)
+			if (!x->calg) {
+				err = -ENOMEM;
 				goto out;
+			}
 			strcpy(x->calg->alg_name, a->name);
 			x->props.calgo = sa->sadb_sa_encrypt;
 		} else {
@@ -1182,8 +1186,10 @@ static struct xfrm_state * pfkey_msg2xfr
 			if (key)
 				keysize = (key->sadb_key_bits + 7) / 8;
 			x->ealg = kmalloc(sizeof(*x->ealg) + keysize, GFP_KERNEL);
-			if (!x->ealg)
+			if (!x->ealg) {
+				err = -ENOMEM;
 				goto out;
+			}
 			strcpy(x->ealg->alg_name, a->name);
 			x->ealg->alg_key_len = 0;
 			if (key) {
@@ -1227,8 +1233,10 @@ static struct xfrm_state * pfkey_msg2xfr
 		struct xfrm_encap_tmpl *natt;
 
 		x->encap = kmalloc(sizeof(*x->encap), GFP_KERNEL);
-		if (!x->encap)
+		if (!x->encap) {
+			err = -ENOMEM;
 			goto out;
+		}
 
 		natt = x->encap;
 		n_type = ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1];

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.18 00/36] 3.18.60-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:40 +0200
  [PATCH 3.18 15/36] arm64: cpuinfo: Missing NULL terminator in compat_hwcap_str Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:40 +0200
  [PATCH 3.18 34/36] cpufreq: s3c2416: double free on driver init error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:40 +0200
  [PATCH 3.18 18/36] MIPS: Fix IRQ tracing & lockdep when rescheduling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:40 +0200
  [PATCH 3.18 25/36] net: korina: Fix NAPI versus resources freeing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:40 +0200
  Re: [PATCH 3.18 14/36] NFSv4: fix a reference leak caused WARNING  messages Trond Myklebust <trondmy@primarydata.com> - 2017-07-03 16:40 +0200
    Re: [PATCH 3.18 14/36] NFSv4: fix a reference leak caused WARNING  messages "gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
  [PATCH 3.18 28/36] xfrm: NULL dereference on allocation failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 31/36] ARM: 8685/1: ensure memblock-limit is pmd-aligned Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 11/36] ipv6: fix calling in6_ifa_hold incorrectly for dad work Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 32/36] iommu/vt-d: Dont over-free page table directories Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 06/36] decnet: dn_rtmsg: Improve input length sanitization in dnrmg_receive_user_skb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 27/36] xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 05/36] net: dont call strlen on non-terminated string in dev_set_alias() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 29/36] xfrm: Oops on error in pfkey_msg2xfrm_state() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 07/36] Fix an intermittent pr_emerg warning about lo becoming free. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 20/36] drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 16/36] MIPS: Avoid accidental raw backtrace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 14/36] NFSv4: fix a reference leak caused WARNING messages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 08/36] net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 30/36] watchdog: bcm281xx: Fix use of uninitialized spinlock. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 17/36] MIPS: pm-cps: Drop manual cache-line alignment of ready_count Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  Re: [PATCH 3.18 00/36] 3.18.60-stable review Guenter Roeck <linux@roeck-us.net> - 2017-07-03 21:40 +0200

csiph-web