From: Navid Emamdoost <[email protected]> nla_nest_start() may fail and return NULL. Insert a check and set errno based on other call sites within the same source code.
Signed-off-by: Navid Emamdoost <[email protected]> Reviewed-by: Michal Kubecek <[email protected]> Fixes: 47d902b90a32 ("nbd: add a status netlink command") Signed-off-by: Kees Cook <[email protected]> --- v3- https://lore.kernel.org/lkml/[email protected]/ Resending on behalf of the author. This seems to have gotten lost and has been getting tracked as CVE-2019-16089 ever since. For example: https://ubuntu.com/security/CVE-2019-16089 --- drivers/block/nbd.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 33a8f37bb6a1..b7c332528ed7 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -2433,6 +2433,12 @@ static int nbd_genl_status(struct sk_buff *skb, struct genl_info *info) } dev_list = nla_nest_start_noflag(reply, NBD_ATTR_DEVICE_LIST); + if (!dev_list) { + nlmsg_free(reply); + ret = -EMSGSIZE; + goto out; + } + if (index == -1) { ret = idr_for_each(&nbd_index_idr, &status_cb, reply); if (ret) { -- 2.34.1
