2022-06-24 08:24:39

by Katrin Jo

Subject: [PATCH] ipv6/sit: fix ipip6_tunnel_get_prl when memory allocation fails

From: katrinzhou <[email protected]>

Fix an illegal copy_to_user() attempt when the system fails to
allocate memory for prl due to a lack of memory.

Addresses-Coverity: ("Unused value")
Fixes: 300aaeeaab5f ("[IPV6] SIT: Add SIOCGETPRL ioctl to get/dump PRL.")
Signed-off-by: katrinzhou <[email protected]>
---
net/ipv6/sit.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index c0b138c20992..4fb84c0b30be 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -323,8 +323,6 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
kcalloc(cmax, sizeof(*kp), GFP_KERNEL_ACCOUNT | __GFP_NOWARN) :
NULL;

- rcu_read_lock();
-
ca = min(t->prl_count, cmax);

if (!kp) {
@@ -337,11 +335,12 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
__GFP_NOWARN);
if (!kp) {
ret = -ENOMEM;
- goto out;
+ goto err;
}
}

c = 0;
+ rcu_read_lock();
for_each_prl_rcu(t->prl) {
if (c >= cmax)
break;
@@ -362,7 +361,7 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
ret = -EFAULT;

kfree(kp);
-
+err:
return ret;
}

--
2.27.0

2022-06-24 16:02:31

by David Ahern

Subject: Re: [PATCH] ipv6/sit: fix ipip6_tunnel_get_prl when memory allocation fails

On 6/24/22 2:12 AM, [email protected] wrote:
> diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
> index c0b138c20992..4fb84c0b30be 100644
> --- a/net/ipv6/sit.c
> +++ b/net/ipv6/sit.c
> @@ -323,8 +323,6 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> kcalloc(cmax, sizeof(*kp), GFP_KERNEL_ACCOUNT | __GFP_NOWARN) :
> NULL;
>
> - rcu_read_lock();
> -
> ca = min(t->prl_count, cmax);
>
> if (!kp) {
> @@ -337,11 +335,12 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> __GFP_NOWARN);
> if (!kp) {
> ret = -ENOMEM;
> - goto out;
> + goto err;
> }
> }
>
> c = 0;
> + rcu_read_lock();
> for_each_prl_rcu(t->prl) {
> if (c >= cmax)
> break;
> @@ -362,7 +361,7 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> ret = -EFAULT;
>
> kfree(kp);
> -
> +err:
> return ret;
> }
>

'out' label is no longer used and should be removed.

2022-06-25 05:58:02

by Katrin Jo

Subject: Re: [PATCH] ipv6/sit: fix ipip6_tunnel_get_prl when memory allocation fails

On Fri, Jun 24, 2022 at 11:12 PM David Ahern <[email protected]> wrote:
>
> On 6/24/22 2:12 AM, [email protected] wrote:
> > diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
> > index c0b138c20992..4fb84c0b30be 100644
> > --- a/net/ipv6/sit.c
> > +++ b/net/ipv6/sit.c
> > @@ -323,8 +323,6 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> > kcalloc(cmax, sizeof(*kp), GFP_KERNEL_ACCOUNT | __GFP_NOWARN) :
> > NULL;
> >
> > - rcu_read_lock();
> > -
> > ca = min(t->prl_count, cmax);
> >
> > if (!kp) {
> > @@ -337,11 +335,12 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> > __GFP_NOWARN);
> > if (!kp) {
> > ret = -ENOMEM;
> > - goto out;
> > + goto err;
> > }
> > }
> >
> > c = 0;
> > + rcu_read_lock();
> > for_each_prl_rcu(t->prl) {
> > if (c >= cmax)
> > break;
> > @@ -362,7 +361,7 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> > ret = -EFAULT;
> >
> > kfree(kp);
> > -
> > +err:
> > return ret;
> > }
> >
>
> 'out' label is no longer used and should be removed.

Thanks for reviewing! I sent the V2 patch, modified according to your
suggestion.
The label is removed, and I still use the label "out" instead of "err".

Best Regards,
Katrin