Received: by 2002:a25:ad19:0:0:0:0:0 with SMTP id y25csp140904ybi; Fri, 26 Jul 2019 07:23:16 -0700 (PDT) X-Google-Smtp-Source: APXvYqyJRMHbK8TnMTPPa6jDoIN/J/sII7NW3VyMC231BE/0fMeRQitl2vCxlUdbGh9GrfSqk17T X-Received: by 2002:a63:a35c:: with SMTP id v28mr48208890pgn.144.1564150995955; Fri, 26 Jul 2019 07:23:15 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1564150995; cv=none; d=google.com; s=arc-20160816; b=rMpvSJuoI55UoMuvgIPahaMz6qlcYNK6Zha+P3Vp57q8+fWyBZTcRse6HxNIOdyatT 3us5dDJDpe+Hryik0oqdjTiE9eArj7FaGYC0QmHU1SMW86ZGk2KQspYpiugbtgmrHz4Y yuYp3WBWSuk2/kLjVDbD7kVuf9RPBEALN9O59bpjAGik5KkvaS08YYzWaQUAjvDTptIL HovdHMo8b1hzBLylwhsqmjegfB80OPYJk8DLnBMIHsqFvnGAUL2i84yrax4XxXILfBxt YXpX9rBBXZw0nHoBsebMEVKHrSLuViYSkG5aEOikRqyrflyPve/np5UloOS1Kl3WOO2L s9ZA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding :content-language:in-reply-to:mime-version:user-agent:date :message-id:from:references:cc:to:subject; bh=IUwWd7OXeYNpitAlT9pNgKF7jd1ZGfYN6YJ+83u4ry8=; b=FxrDyoV0eMyoQZdA6VHyLVMTLQUd8DK89zX/ukujxSQijgn+zxeQ6Uig8tzi1JTQqX 9i0i35z/8nPigC35//lbR4DY7BzRU6AsDv83E4aLnSogeL8fxuT8LVZsdMvXzLXA5+QP BaSTtUOPUxpGt8w+dpouPC7upP6/PzPX+C3p+oQPHQu8i/CAh26twcgXgn/8wdrNhbBz k3Xe281LXwPqSmxiniLFaeGi8a8jORLEgD9gDkaWyFxl9r1f0yijn17W70Luz394+E3M Nw98D+JXiygDDxj/M4kls0Tmg/nb3bz8l10pZlgc4we2ZBwJLWH0Smjrakv8ovQAVXfN a7Ig== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id y192si20512409pfg.172.2019.07.26.07.23.00; Fri, 26 Jul 2019 07:23:15 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727941AbfGZOVf (ORCPT + 99 others); Fri, 26 Jul 2019 10:21:35 -0400 Received: from mail.windriver.com ([147.11.1.11]:46178 "EHLO mail.windriver.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725869AbfGZOVe (ORCPT ); Fri, 26 Jul 2019 10:21:34 -0400 Received: from ALA-HCA.corp.ad.wrs.com ([147.11.189.40]) by mail.windriver.com (8.15.2/8.15.1) with ESMTPS id x6QELHDd021105 (version=TLSv1 cipher=AES128-SHA bits=128 verify=FAIL); Fri, 26 Jul 2019 07:21:17 -0700 (PDT) Received: from [128.224.155.90] (128.224.155.90) by ALA-HCA.corp.ad.wrs.com (147.11.189.50) with Microsoft SMTP Server (TLS) id 14.3.468.0; Fri, 26 Jul 2019 07:21:16 -0700 Subject: Re: [PATCH] net: tipc: Fix a possible null-pointer dereference in tipc_publ_purge() To: Jia-Ju Bai , , CC: , , References: <20190725092021.15855-1-baijiaju1990@gmail.com> From: Ying Xue Message-ID: <31091d78-8c10-f07d-b738-4c082d33f1c9@windriver.com> Date: Fri, 26 Jul 2019 22:10:17 +0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.1 MIME-Version: 1.0 In-Reply-To: <20190725092021.15855-1-baijiaju1990@gmail.com> Content-Type: text/plain; charset="utf-8" Content-Language: en-US Content-Transfer-Encoding: 7bit X-Originating-IP: [128.224.155.90] Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 7/25/19 5:20 PM, Jia-Ju Bai wrote: > In tipc_publ_purge(), there is an if statement on 215 to > check whether p is NULL: > if (p) > > When p is NULL, it is used on line 226: > kfree_rcu(p, rcu); > > Thus, a possible null-pointer dereference may occur. > > To fix this bug, p is checked before being used. > > This bug is found by a static analysis tool STCheck written by us. > > Signed-off-by: Jia-Ju Bai > --- > net/tipc/name_distr.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c > index 44abc8e9c990..241ed2274473 100644 > --- a/net/tipc/name_distr.c > +++ b/net/tipc/name_distr.c > @@ -223,7 +223,8 @@ static void tipc_publ_purge(struct net *net, struct publication *publ, u32 addr) > publ->key); > } > > - kfree_rcu(p, rcu); > + if (p) No, I don't think so because kfree_rcu() will internally check if "p" pointer is NULL or not. > + kfree_rcu(p, rcu); > } > > /** >