Received: by 2002:a25:d7c1:0:0:0:0:0 with SMTP id o184csp1288724ybg; Fri, 18 Oct 2019 15:16:55 -0700 (PDT) X-Google-Smtp-Source: APXvYqzX1SF6ig8PzJM8OipVlg+Zl80C82cWAIGZLXqJOUxmv1DLIY4zid46T5j0qHOIbJ3FkO/z X-Received: by 2002:aa7:db43:: with SMTP id n3mr12331004edt.176.1571437015765; Fri, 18 Oct 2019 15:16:55 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1571437015; cv=none; d=google.com; s=arc-20160816; b=SPMGEAFdJwyvaeCEw+VkYYuadHhkqizyXBT9Gw+/QCL+DICRyYAKbFNBcPzYKlTi7k CAzrE2MiIZ4XHUCAUkhkGQOW+uaFOspykb8qzKOyPFfsSEMjnz3LhUxbjMk//omG9jtP 3PF4Ydg1M5IkT6Bn1q2Jmx5lNZivD7IFpXFPu0MdsHZzb5JKHT7L/AiCAqgUNDDXiAHG GPcEtkmNHfhP4hKkcBNrz56zH4uruvakURHPnQ1rKCrarnSy+pKn0Cn81CkQv9mXTZ0O wxiRMWxtq3FtcmZaD6bJuSbdce262YMr5meYoJz14C3YoUQGeuiDEUCVIHt+jzS/Izrh GiiA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:date:content-transfer-encoding :mime-version:cc:to:rt-originator:managed-by:rt-ticket:message-id :references:in-reply-to:reply-to:subject:from; bh=rIV+md1AyJmAXzz6y/Ire+j4PTW7V63nmP9c9RFYQco=; b=CJcNL419QbBgpcNAsCxmrofbsrvMOU1eWJqKa+l/V48W3i+LapnJpXquYVnkpG5Rcw /p5x7ixFlzgppyyJD8wHkX+hmib2kXY32jfX2fxpMQs34LIVe6WibikfOXXW9/7E1YQ5 TNpkA4dBsdlcPK6zRXQxn/ULYhoUhazzBu6GrSbe9sBMauE9Ngm6nOAndah5UxYmGKxx jeYoumHoyhqXNifH6NLzDXMqGg3j7KNImsBkFuVXjNgZaS/sUVgNGOASK/NRXgaj/KCl 1kF+02qfjSMK0wMA3dIxiRl2IKhWlzT0lTX2EHFuecVFl7KOCTzQZThrG8ykjALeV4ZS nr2Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redhat.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id s20si4283087ejx.223.2019.10.18.15.16.32; Fri, 18 Oct 2019 15:16:55 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2394357AbfJQThR (ORCPT + 99 others); Thu, 17 Oct 2019 15:37:17 -0400 Received: from mx1.redhat.com ([209.132.183.28]:5549 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728856AbfJQThR (ORCPT ); Thu, 17 Oct 2019 15:37:17 -0400 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 73C45308FFB1; Thu, 17 Oct 2019 19:37:16 +0000 (UTC) Received: from rt4.app.eng.rdu2.redhat.com (rt4.app.eng.rdu2.redhat.com [10.10.161.56]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 4943C19C70; Thu, 17 Oct 2019 19:37:16 +0000 (UTC) Received: from rt4.app.eng.rdu2.redhat.com (localhost [127.0.0.1]) by rt4.app.eng.rdu2.redhat.com (8.14.4/8.14.4) with ESMTP id x9HJbFjn017092; Thu, 17 Oct 2019 15:37:15 -0400 Received: (from apache@localhost) by rt4.app.eng.rdu2.redhat.com (8.14.4/8.14.4/Submit) id x9HJbECL017089; Thu, 17 Oct 2019 15:37:14 -0400 From: Red Hat Product Security X-PGP-Public-Key: https://www.redhat.com/security/650d5882.txt Subject: [engineering.redhat.com #498403] Re: [PATCH v2] nbd_genl_status: null check for nla_nest_start Reply-To: secalert@redhat.com In-Reply-To: References: <20190729130912.7imtg3hfnvb4lt2y@MacBook-Pro-91.local> <20190729164226.22632-1-navid.emamdoost@gmail.com> <20190910113521.GA9895@unicorn.suse.cz> Message-ID: X-RT-Loop-Prevention: engineering.redhat.com RT-Ticket: engineering.redhat.com #498403 Managed-BY: RT 4.0.13 (http://www.bestpractical.com/rt/) RT-Originator: kbost@redhat.com To: navid.emamdoost@gmail.com CC: axboe@kernel.dk, emamd001@umn.edu, josef@toxicpanda.com, kjlu@umn.edu, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, mkubecek@suse.cz, nbd@other.debian.org, smccaman@umn.edu MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="utf-8" X-RT-Original-Encoding: utf-8 Date: Thu, 17 Oct 2019 15:37:14 -0400 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.49]); Thu, 17 Oct 2019 19:37:16 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Navid, Not sure if you meant to cc secalert@redhat.com on this. If anything is needed from our side please let us know! On Wed Oct 16 22:17:42 2019, navid.emamdoost@gmail.com wrote: > Hi Michal, please check v3 at > https://lore.kernel.org/patchwork/patch/1126650/ > > > Thanks, > Navid. > > On Tue, Sep 10, 2019 at 6:35 AM Michal Kubecek > wrote: > > > > (Just stumbled upon this patch when link to it came with a CVE bug > report.) > > > > On Mon, Jul 29, 2019 at 11:42:26AM -0500, Navid Emamdoost wrote: > > > nla_nest_start may fail and return NULL. The check is inserted, > and > > > errno is selected based on other call sites within the same source > code. > > > Update: removed extra new line. > > > > > > Signed-off-by: Navid Emamdoost > > > Reviewed-by: Bob Liu > > > --- > > > drivers/block/nbd.c | 5 +++++ > > > 1 file changed, 5 insertions(+) > > > > > > diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c > > > index 9bcde2325893..2410812d1e82 100644 > > > --- a/drivers/block/nbd.c > > > +++ b/drivers/block/nbd.c > > > @@ -2149,6 +2149,11 @@ static int nbd_genl_status(struct sk_buff > *skb, struct genl_info *info) > > > } > > > > > > dev_list = nla_nest_start_noflag(reply, > NBD_ATTR_DEVICE_LIST); > > > + if (!dev_list) { > > > + ret = -EMSGSIZE; > > > + goto out; > > > + } > > > + > > > if (index == -1) { > > > ret = idr_for_each(&nbd_index_idr, &status_cb, > reply); > > > if (ret) { > > > > You should also call nlmsg_free(reply) when you bail out so that you > > don't introduce a memory leak. > > > > Michal Kubecek > > > -- Kat Bost Red Hat Product Security