lkml.org 
[lkml]   [2017]   [Nov]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.10 104/139] xfrm: NULL dereference on allocation failure
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    commit e747f64336fc15e1c823344942923195b800aa1e upstream.

    The default error code in pfkey_msg2xfrm_state() is -ENOBUFS. We
    added a new call to security_xfrm_state_alloc() which sets "err" to zero
    so there several places where we can return ERR_PTR(0) if kmalloc()
    fails. The caller is expecting error pointers so it leads to a NULL
    dereference.

    Fixes: df71837d5024 ("[LSM-IPSec]: Security association restriction.")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
    Signed-off-by: Willy Tarreau <w@1wt.eu>
    ---
    net/key/af_key.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/net/key/af_key.c b/net/key/af_key.c
    index 66f51c5..b3191ef 100644
    --- a/net/key/af_key.c
    +++ b/net/key/af_key.c
    @@ -1135,6 +1135,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
    goto out;
    }

    + err = -ENOBUFS;
    key = ext_hdrs[SADB_EXT_KEY_AUTH - 1];
    if (sa->sadb_sa_auth) {
    int keysize = 0;
    --
    2.8.0.rc2.1.gbe9624a
    \
     
     \ /
      Last update: 2017-11-01 22:34    [W:4.102 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site