Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751789AbcDKDCL (ORCPT ); Sun, 10 Apr 2016 23:02:11 -0400 Received: from shards.monkeyblade.net ([149.20.54.216]:57079 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751670AbcDKDCJ (ORCPT ); Sun, 10 Apr 2016 23:02:09 -0400 Date: Sun, 10 Apr 2016 23:02:01 -0400 (EDT) Message-Id: <20160410.230201.2150110742043110823.davem@davemloft.net> To: vegard.nossum@oracle.com Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, eric.dumazet@gmail.com, sasha.levin@oracle.com Subject: Re: [PATCH] net: mark DECnet as broken From: David Miller In-Reply-To: <1460013763-22985-1-git-send-email-vegard.nossum@oracle.com> References: <1460013763-22985-1-git-send-email-vegard.nossum@oracle.com> X-Mailer: Mew version 6.7 on Emacs 24.5 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Sun, 10 Apr 2016 20:02:03 -0700 (PDT) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2057 Lines: 68 From: Vegard Nossum Date: Thu, 7 Apr 2016 09:22:43 +0200 > There are NULL pointer dereference bugs in DECnet which can be triggered > by unprivileged users and have been reported multiple times to LKML, > however nobody seems confident enough in the proposed fixes to merge them > and the consensus seems to be that nobody cares enough about DECnet to > see it fixed anyway. > > To shield unsuspecting users from the possible DOS, we should mark this > BROKEN until somebody who actually uses this code can fix it. > > Signed-off-by: Vegard Nossum > Link: https://lkml.org/lkml/2015/12/17/666 As stated, I'm not applying this, and rather I am fixing this as below: ==================== [PATCH] decnet: Do not build routes to devices without decnet private data. In particular, make sure we check for decnet private presence for loopback devices. Signed-off-by: David S. Miller --- net/decnet/dn_route.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c index 607a14f..b1dc096 100644 --- a/net/decnet/dn_route.c +++ b/net/decnet/dn_route.c @@ -1034,10 +1034,13 @@ source_ok: if (!fld.daddr) { fld.daddr = fld.saddr; - err = -EADDRNOTAVAIL; if (dev_out) dev_put(dev_out); + err = -EINVAL; dev_out = init_net.loopback_dev; + if (!dev_out->dn_ptr) + goto out; + err = -EADDRNOTAVAIL; dev_hold(dev_out); if (!fld.daddr) { fld.daddr = @@ -1110,6 +1113,8 @@ source_ok: if (dev_out == NULL) goto out; dn_db = rcu_dereference_raw(dev_out->dn_ptr); + if (!dn_db) + goto e_inval; /* Possible improvement - check all devices for local addr */ if (dn_dev_islocal(dev_out, fld.daddr)) { dev_put(dev_out); @@ -1151,6 +1156,8 @@ select_source: dev_put(dev_out); dev_out = init_net.loopback_dev; dev_hold(dev_out); + if (!dev_out->dn_ptr) + goto e_inval; fld.flowidn_oif = dev_out->ifindex; if (res.fi) dn_fib_info_put(res.fi); -- 2.1.0