Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20220625054524.2445867-1-zys.zljxml@gmail.com> <CANn89iKyovwB1WC0FbGV3tqz2f+0rSShtPjStuEhvyygSjOGrQ@mail.gmail.com>
In-Reply-To: <CANn89iKyovwB1WC0FbGV3tqz2f+0rSShtPjStuEhvyygSjOGrQ@mail.gmail.com>
From:   Katrin Jo <zys.zljxml@gmail.com>
Date:   Mon, 27 Jun 2022 19:18:00 +0800
Message-ID: <CAOaDN_RSOdrWK0wKs__PWENzH8-hx9ynCF0Q71PqxtZo5TJriQ@mail.gmail.com>
Subject: Re: [PATCH v2] ipv6/sit: fix ipip6_tunnel_get_prl when memory
 allocation fails
To:     Eric Dumazet <edumazet@google.com>
Cc:     LKML <linux-kernel@vger.kernel.org>,
        netdev <netdev@vger.kernel.org>,
        Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
        David Ahern <dsahern@kernel.org>,
        Jakub Kicinski <kuba@kernel.org>,
        David Miller <davem@davemloft.net>,
        Eric Dumazet <eric.dumazet@gmail.com>,
        Paolo Abeni <pabeni@redhat.com>,
        katrinzhou <katrinzhou@tencent.com>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Mon, Jun 27, 2022 at 5:01 PM Eric Dumazet <edumazet@google.com> wrote:
>
> On Sat, Jun 25, 2022 at 7:45 AM <zys.zljxml@gmail.com> wrote:
> >
> > From: katrinzhou <katrinzhou@tencent.com>
> >
> > Fix an illegal copy_to_user() attempt when the system fails to
> > allocate memory for prl due to a lack of memory.
>
> I do not really see an illegal copy_to_user()
>
> c = 0
> -> len = 0
>
> if ((len && copy_to_user(a + 1, kp, len)) || put_user(len, &a->datalen))
>
> So the copy_to_user() should not be called ?
>
> I think you should only mention that after this patch, correct error
> code is returned (-ENOMEM)
>
>
> >
> > Addresses-Coverity: ("Unused value")
> > Fixes: 300aaeeaab5f ("[IPV6] SIT: Add SIOCGETPRL ioctl to get/dump PRL.")
> > Signed-off-by: katrinzhou <katrinzhou@tencent.com>
> > ---
> >
> > Changes in v2:
> > - Move the position of label "out"
> >
> >  net/ipv6/sit.c | 7 +++----
> >  1 file changed, 3 insertions(+), 4 deletions(-)
> >
> > diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
> > index c0b138c20992..3330882c0f94 100644
> > --- a/net/ipv6/sit.c
> > +++ b/net/ipv6/sit.c
> > @@ -323,8 +323,6 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> >                 kcalloc(cmax, sizeof(*kp), GFP_KERNEL_ACCOUNT | __GFP_NOWARN) :
> >                 NULL;
> >
> > -       rcu_read_lock();
> > -
> >         ca = min(t->prl_count, cmax);
> >
> >         if (!kp) {
> > @@ -342,6 +340,7 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> >         }
> >
> >         c = 0;
> > +       rcu_read_lock();
> >         for_each_prl_rcu(t->prl) {
> >                 if (c >= cmax)
> >                         break;
> > @@ -353,7 +352,7 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> >                 if (kprl.addr != htonl(INADDR_ANY))
> >                         break;
> >         }
> > -out:
> > +
> >         rcu_read_unlock();
> >
> >         len = sizeof(*kp) * c;
> > @@ -362,7 +361,7 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> >                 ret = -EFAULT;
> >
> >         kfree(kp);
> > -
> > +out:
> >         return ret;
> >  }
> >
> > --
> > 2.27.0
> >

Thanks for pointing that out. I will modify the message in the next
version of the patch.
And, could c = 0 (line 344) be removed? It is initialized at the beginning.
I think it is a cleanup work.

Best Regards,
Katrin