Begin forwarded message:
Date: Sat, 22 Apr 2017 14:49:46 +0000 From: bugzilla-dae...@bugzilla.kernel.org To: step...@networkplumber.org Subject: [Bug 195495] New: unchecked return value of nla_nest_start() in function lwtunnel_fill_encap() https://bugzilla.kernel.org/show_bug.cgi?id=195495 Bug ID: 195495 Summary: unchecked return value of nla_nest_start() in function lwtunnel_fill_encap() Product: Networking Version: 2.5 Kernel Version: linux-4.11-rc7 Hardware: All OS: Linux Tree: Mainline Status: NEW Severity: normal Priority: P1 Component: Other Assignee: step...@networkplumber.org Reporter: bianpan2...@ruc.edu.cn Regression: No Function nla_nest_start() may return a NULL pointer on error. However, in function lwtunnel_fill_encap(), the return value of nla_nest_start() is not checked against NULL (see line 218), and may result in bad memory access. Related code snippets are shown as follows. lwtunnel_fill_encap @@ net/core/lwtunnel.c: 204 204 int lwtunnel_fill_encap(struct sk_buff *skb, struct lwtunnel_state *lwtstate) 205 { 206 const struct lwtunnel_encap_ops *ops; 207 struct nlattr *nest; 208 int ret = -EINVAL; 209 210 if (!lwtstate) 211 return 0; 212 213 if (lwtstate->type == LWTUNNEL_ENCAP_NONE || 214 lwtstate->type > LWTUNNEL_ENCAP_MAX) 215 return 0; 216 217 ret = -EOPNOTSUPP; 218 nest = nla_nest_start(skb, RTA_ENCAP); 219 rcu_read_lock(); 220 ops = rcu_dereference(lwtun_encaps[lwtstate->type]); 221 if (likely(ops && ops->fill_encap)) 222 ret = ops->fill_encap(skb, lwtstate); 223 rcu_read_unlock(); 224 225 if (ret) 226 goto nla_put_failure; 227 nla_nest_end(skb, nest); 228 ret = nla_put_u16(skb, RTA_ENCAP_TYPE, lwtstate->type); 229 if (ret) 230 goto nla_put_failure; 231 232 return 0; 233 234 nla_put_failure: 235 nla_nest_cancel(skb, nest); 236 237 return (ret == -EOPNOTSUPP ? 0 : ret); 238 } Generally, the return value of function nla_nest_start() should be checked against NULL, as follows. rtnetlink_put_metrics @@ net/core/rtnetlink.c: 686 int rtnetlink_put_metrics(struct sk_buff *skb, u32 *metrics) 687 { 688 struct nlattr *mx; 689 int i, valid = 0; 690 691 mx = nla_nest_start(skb, RTA_METRICS); 692 if (mx == NULL) 693 return -ENOBUFS; ... 726 return nla_nest_end(skb, mx); 727 728 nla_put_failure: 729 nla_nest_cancel(skb, mx); 730 return -EMSGSIZE; 731 } Thanks very much for your attention! Pan Bian -- You are receiving this mail because: You are the assignee for the bug.
