Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH] net: xfrm: Fix potential oops in xfrm_user_rcv_msg and
 array out of bounds
To:     Steffen Klassert <steffen.klassert@secunet.com>
CC:     Herbert Xu <herbert@gondor.apana.org.au>, <davem@davemloft.net>,
        <netdev@vger.kernel.org>, <linux-kernel@vger.kernel.org>
References: <1551671259-21311-1-git-send-email-suyj.fnst@cn.fujitsu.com>
 <20190305064920.gcpwvkp7yikq33cy@gondor.apana.org.au>
 <d401c74f-43cd-7abe-a02d-7397b09b1784@cn.fujitsu.com>
 <20190305073117.GD14737@gauss3.secunet.de>
From:   "Su Yanjun <suyj.fnst@cn.fujitsu.com>" <suyj.fnst@cn.fujitsu.com>
Message-ID: <be2976e7-f2c1-b936-af3b-6454451776b0@cn.fujitsu.com>
Date:   Tue, 5 Mar 2019 15:39:19 +0800
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:60.0) Gecko/20100101
 Thunderbird/60.3.3
MIME-Version: 1.0
In-Reply-To: <20190305073117.GD14737@gauss3.secunet.de>
Content-Type: text/plain; charset="gbk"; format=flowed
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


On 2019/3/5 15:31, Steffen Klassert wrote:
> On Tue, Mar 05, 2019 at 03:08:49PM +0800, Su Yanjun <suyj.fnst@cn.fujitsu.com> wrote:
>> On 2019/3/5 14:49, Herbert Xu wrote:
>>
>>> On Sun, Mar 03, 2019 at 10:47:39PM -0500, Su Yanjun wrote:
>>>> When i review xfrm_user.c code, i found some potentical bug in it.
>>>>
>>>> In xfrm_user_rcvmsg if type parameter from user space is set to
>>>> XFRM_MSG_MAX or  XFRM_MSG_NEWSADINFO or XFRM_MSG_NEWSPDINFO. It will cause
>>>> xfrm_user_rcv_msg  referring to null entry in xfrm_dispatch array.
>>>>
>>>> Signed-off-by: Su Yanjun <suyj.fnst@cn.fujitsu.com>
>>>> ---
>>>>    net/xfrm/xfrm_user.c | 4 +++-
>>>>    1 file changed, 3 insertions(+), 1 deletion(-)
>>>>
>>>> diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
>>>> index a131f9f..d832783 100644
>>>> --- a/net/xfrm/xfrm_user.c
>>>> +++ b/net/xfrm/xfrm_user.c
>>>> @@ -2630,11 +2630,13 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
>>>>    		return -EOPNOTSUPP;
>>>>    	type = nlh->nlmsg_type;
>>>> -	if (type > XFRM_MSG_MAX)
>>>> +	if (type >= XFRM_MSG_MAX)
>>>>    		return -EINVAL;
>>> Your patch is wrong.  Please check the definition of XFRM_MSG_MAX.
>> I see, thanks for your reply.
>>
>>   	type -= XFRM_MSG_BASE;
>>   	link = &xfrm_dispatch[type];
>> +	if (!link)
>> +		return -EOPNOTSUPP;
>>
>> Here **link** may refer to null entry for special types such as
>> XFRM_MSG_MAX or  XFRM_MSG_NEWSADINFO or XFRM_MSG_NEWSPDINFO
>> Am i miss something?
> 'link' is always a valid pointer into that array.

Thanks

Su