From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1760967AbYDPVaf (ORCPT ); Wed, 16 Apr 2008 17:30:35 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1753361AbYDPVaY (ORCPT ); Wed, 16 Apr 2008 17:30:24 -0400 Received: from yw-out-2324.google.com ([74.125.46.31]:52617 "EHLO yw-out-2324.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752783AbYDPVaX (ORCPT ); Wed, 16 Apr 2008 17:30:23 -0400 DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=lm7iUr71XuMrEV6H/kxRGuYEDbYJygrY/sq2gnSXCsf8XGvjpLCzhMRxs4m0hMZ6ztS91PimwDmf3nuZqH8dE+xBk/d3QnyrybuKAj9Z7Ap+UWa+/f4bt2Mr4pXeo2V5pt6y+jR0LeYfiSqVhS5mngLYnFmxCd5nCwdVH+NzbZM= Message-ID: <9a8748490804161430w3a9a9ed8o4dcc80d260a14500@mail.gmail.com> Date: Wed, 16 Apr 2008 23:30:10 +0200 From: "Jesper Juhl" To: "Paul Moore" Subject: Re: [PATCH][netlabel] Don't risk NULL ptr deref in netlbl_unlabel_staticlist_gen() if ifindex not found Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, "David Miller" In-Reply-To: <200804161721.33749.paul.moore@hp.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <200804161721.33749.paul.moore@hp.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 16/04/2008, Paul Moore wrote: > On Wednesday 16 April 2008 5:08:58 pm Jesper Juhl wrote: > > Hi, > > > > dev_get_by_index() may return NULL if nothing is found. In > > net/netlabel/netlabel_unlabeled.c::netlbl_unlabel_staticlist_gen() > > the function is called, but the return value is never checked. If it > > returns NULL then we'll deref a NULL pointer on the very next line. > > I checked the callers, and I don't think this can actually happen > > today, but code changes over time and in the future it might happen > > and it does no harm to be defensive and check for the failure, so > > that if/when it happens we'll fail gracefully instead of crashing. > > > > Please consider the patch below for inclusion. > > > > > > Signed-off-by: Jesper Juhl > > > I agree we should check for NULL here. I checked the return of > dev_get_by_index() in the rest of the file I must have just forgotten > to check it here. > > Thanks for finding this and fixing it. > You're welcome. > Acked-by: Paul Moore > David, will you merge this in the net tree ? > > > > > netlabel_unlabeled.c | 4 ++++ > > 1 file changed, 4 insertions(+) > > > > diff --git a/net/netlabel/netlabel_unlabeled.c > > b/net/netlabel/netlabel_unlabeled.c index 4478f2f..6af9457 100644 > > --- a/net/netlabel/netlabel_unlabeled.c > > +++ b/net/netlabel/netlabel_unlabeled.c > > @@ -1339,6 +1339,10 @@ static int netlbl_unlabel_staticlist_gen(u32 > > cmd, > > > > if (iface->ifindex > 0) { > > dev = dev_get_by_index(&init_net, iface->ifindex); > > + if (!dev) { > > + ret_val = -ENODEV; > > + goto list_cb_failure; > > + } > > ret_val = nla_put_string(cb_arg->skb, > > NLBL_UNLABEL_A_IFACE, dev->name); > > dev_put(dev); > -- Jesper Juhl Don't top-post http://www.catb.org/~esr/jargon/html/T/top-post.html Plain text mails only, please http://www.expita.com/nomime.html