From patchwork Fri Jul 26 08:03:07 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jia-Ju Bai X-Patchwork-Id: 1137303 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="en3ja7Hy"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 45w1mW2QmMz9sBF for ; Fri, 26 Jul 2019 18:03:23 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726297AbfGZIDT (ORCPT ); Fri, 26 Jul 2019 04:03:19 -0400 Received: from mail-pg1-f194.google.com ([209.85.215.194]:42073 "EHLO mail-pg1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725815AbfGZIDT (ORCPT ); Fri, 26 Jul 2019 04:03:19 -0400 Received: by mail-pg1-f194.google.com with SMTP id t132so24380270pgb.9; Fri, 26 Jul 2019 01:03:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=ezk7udNGHpj8DbEIJ/QK4G3fHV7bgQKFf1n90gssYQo=; b=en3ja7HyoKgOPY37rbkkkpAKcd3jXXyZKTnEL91Dcq/q0Tlt+t8iJtE2ZT6824Hcn1 V7TeS/+Hw0FAF4yiWCDOkUhboPVglR8hJ7cIAls7dgJlR0OQKP89SEcWtOfeuptZP3b8 zE2ufeY0BLqnrzxryvVDcfW2YIyFBSED/jRbfck+d0iAwzZGGqRFf4bmh/3w5W9x4dUL q1ASzn5Z9qF32UXqwAM/newgkWDnex6px7geRSJmEc/Bqe/jAaLJJs5mm5gcw7LvUKie t3w0xqBC1udxSllaPpeobGT2dAezNKcI5q9+CbwLlKO+0HXO9dXO3mIYHc82ejxCwHm2 3b7g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=ezk7udNGHpj8DbEIJ/QK4G3fHV7bgQKFf1n90gssYQo=; b=Awg5sIWsbUYxYNg7Ds29nf+xOF1qsEQDfSko+IZ+5C5wVv1gSGMgWAnGlc2E6Tf6OK bwKL04NztfTJwVOt0jh0V069BK2WlimUvmYHW/hTIef40n19xtpBaRpIhGZK1gvcCaNd s1t7U6+sv4kSG36/bZeN+8ENlpCIydJABZN+/h8zuWIp6t9rV6+J9pl9t5/k0lyrjVsN Bw572kwQYSadgdWLhFEU99RuyNien7iS49obuXlx4/0KhWIbxH7CMa2GBuLtjkuKd9Mm 3rQMIkICQ6mDPNKhxwtyWCzfu7hWgr09bxVGaq6CCczY7o6Zlnk0zZ+6EyPvsQN4k3gF Yy0Q== X-Gm-Message-State: APjAAAWkwRMgvahlzSiSSLZxoq9XfzGMvtFE5SPRGdRvoxFDO8n343Ed 9vJQKBhyuZUhDiZoCv3TV48= X-Google-Smtp-Source: APXvYqwZHG3CeVEGEoQyGF0hdHVJkM/QYHRbr5DITZn/g0vK6/+1dNQHLnzULw5PNNjdf4tMGzhzsw== X-Received: by 2002:a17:90a:e397:: with SMTP id b23mr95739307pjz.140.1564128198517; Fri, 26 Jul 2019 01:03:18 -0700 (PDT) Received: from oslab.tsinghua.edu.cn ([2402:f000:4:72:808::3ca]) by smtp.gmail.com with ESMTPSA id v22sm49742272pgk.69.2019.07.26.01.03.16 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 26 Jul 2019 01:03:18 -0700 (PDT) From: Jia-Ju Bai To: davem@davemloft.net, kuznet@ms2.inr.ac.ru, yoshfuji@linux-ipv6.org Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Jia-Ju Bai Subject: [PATCH 1/2] net: ipv6: Fix a possible null-pointer dereference in ip6_xmit() Date: Fri, 26 Jul 2019 16:03:07 +0800 Message-Id: <20190726080307.4414-1-baijiaju1990@gmail.com> X-Mailer: git-send-email 2.17.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org In ip6_xmit(), there is an if statement on line 245 to check whether np is NULL: if (np) When np is NULL, it is used on line 251: ip6_autoflowlabel(net, np) if (!np->autoflowlabel_set) Thus, a possible null-pointer dereference may occur. To fix this bug, np is checked before calling ip6_autoflowlabel(net,np). This bug is found by a static analysis tool STCheck written by us. Signed-off-by: Jia-Ju Bai --- net/ipv6/ip6_output.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 8e49fd62eea9..07db5ab6e970 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -247,8 +247,10 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6, if (hlimit < 0) hlimit = ip6_dst_hoplimit(dst); - ip6_flow_hdr(hdr, tclass, ip6_make_flowlabel(net, skb, fl6->flowlabel, - ip6_autoflowlabel(net, np), fl6)); + if (np) { + ip6_flow_hdr(hdr, tclass, ip6_make_flowlabel(net, skb, fl6->flowlabel, + ip6_autoflowlabel(net, np), fl6)); + } hdr->payload_len = htons(seg_len); hdr->nexthdr = proto; From patchwork Fri Jul 26 08:03:21 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jia-Ju Bai X-Patchwork-Id: 1137304 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="CQwAma3P"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 45w1mh6yJwz9sBF for ; Fri, 26 Jul 2019 18:03:32 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726402AbfGZID2 (ORCPT ); Fri, 26 Jul 2019 04:03:28 -0400 Received: from mail-pg1-f195.google.com ([209.85.215.195]:46185 "EHLO mail-pg1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725815AbfGZID2 (ORCPT ); Fri, 26 Jul 2019 04:03:28 -0400 Received: by mail-pg1-f195.google.com with SMTP id k189so5347411pgk.13; Fri, 26 Jul 2019 01:03:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=aNZ6zNbsaKjh51lz8tJIfnHcrXSDVIs4DFqNHJ79L3E=; b=CQwAma3Pu8O0jCDic//Euaxbbj1NkYvWFtvRH+Dax4Y2t1g9x8oY1qNcwARAvQwCv3 DmXnyVNtcuaFGEKh1wU5hTiE/eknjrSgFkCJg6jcudveZkfGdjY8mXeyaUBctSpH6aGT +3YS2vWMOwuqagfWH4mKiy8UUKboVeRggtmR50fiuqjPsF94g912m1V3KbiL3PcKUX8G oxva2u+G8QHjsSQ7XChFH5r39SiQrql6mP2GnztLW5P6atAPn0w3Al184igFsI8iHHJL BRWBmGfvUqvW1q3zsfyfk0c3hjBdMCK3S7QkKfZ2eElregu9hPvgcjT34az8gVcnzI9E bczQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=aNZ6zNbsaKjh51lz8tJIfnHcrXSDVIs4DFqNHJ79L3E=; b=cAK4zCBKQ/81C5IySC6DIKUDWqhR2hNiWg+T8q4Bq2en1drnOQYiql61itmDHnyRD5 AzLVIQ3NHJLfJT2HcKNo5Tp4AFhi2vlryYddCGats1NnVynacu68xec3yPR5hA++1DQF yUe9bHG1DBGcbgtKQI8hKf4+6n75fO2+CGxpKEwkTs/BhSBj/JILdbs8y+/3EMLxrfAx Zc4cQ1r6Vv9T1D17Pb+GJ6gjdJjTPOkzx8DJsS/Mg5EVYizV17G/Yc0TBXmodyyf/ot8 70F3W7kS3Y7YBszM/XMpqSEhI760z/3Dr0SHFwBOrh3YOzrQeloyB4jdpXNSrX8uLn6l 1x7A== X-Gm-Message-State: APjAAAXolK2TVeTCCbjRYD39piBK/0yR1gnOe7hbe9la9AbbBCeYfZrL GCdsWSDo7oAlwk0QT3zn3F4= X-Google-Smtp-Source: APXvYqy6vAuLBnR+hOegMSm522XbZmn+L9+SYmZ2SWYpWAIunYNoCmlj8nB4Fvijx/H1Rp9DkGGu2g== X-Received: by 2002:a63:36cc:: with SMTP id d195mr49258558pga.157.1564128207719; Fri, 26 Jul 2019 01:03:27 -0700 (PDT) Received: from oslab.tsinghua.edu.cn ([2402:f000:4:72:808::3ca]) by smtp.gmail.com with ESMTPSA id b26sm59386976pfo.129.2019.07.26.01.03.25 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 26 Jul 2019 01:03:27 -0700 (PDT) From: Jia-Ju Bai To: davem@davemloft.net, kuznet@ms2.inr.ac.ru, yoshfuji@linux-ipv6.org Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Jia-Ju Bai Subject: [PATCH 2/2] net: ipv6: Fix a possible null-pointer dereference in vti6_link_config() Date: Fri, 26 Jul 2019 16:03:21 +0800 Message-Id: <20190726080321.4466-1-baijiaju1990@gmail.com> X-Mailer: git-send-email 2.17.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org In vti6_link_config(), there is an if statement on line 649 to check whether rt is NULL: if (rt) When rt is NULL, it is used on line 651: ip6_rt_put(rt); dst_release(&rt->dst); Thus, a possible null-pointer dereference may occur. To fix this bug, ip6_rt_put() is called when rt is not NULL. This bug is found by a static analysis tool STCheck written by us. Signed-off-by: Jia-Ju Bai --- net/ipv6/ip6_vti.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c index 024db17386d2..572647205c52 100644 --- a/net/ipv6/ip6_vti.c +++ b/net/ipv6/ip6_vti.c @@ -646,9 +646,10 @@ static void vti6_link_config(struct ip6_tnl *t, bool keep_mtu) &p->raddr, &p->laddr, p->link, NULL, strict); - if (rt) + if (rt) { tdev = rt->dst.dev; - ip6_rt_put(rt); + ip6_rt_put(rt); + } } if (!tdev && p->link)