https://bugzilla.kernel.org/show_bug.cgi?id=78351
Bug ID: 78351
Summary: Missing NULL check of the return value of
nla_reserve() in function cgroupstats_user_cmd()
Product: Drivers
Version: 2.5
Kernel Version: 2.6.39
Hardware: All
OS: Linux
Tree: Mainline
Status: NEW
Severity: normal
Priority: P1
Component: Infiniband/RDMA
Assignee: [email protected]
Reporter: [email protected]
Regression: No
In function cgroupstats_user_cmd() at kernel/taskstats.c:412, the call to
nla_reserve() at line 338 may return a NULL pointer, but its return value is
never checked against NULL before the call to function nla_data()(called at
line 441), and thus an invalid access error may be triggered.
The related code snippets in function cgroupstats_user_cmd() are as followings.
cgroupstats_user_cmd @ kernel/taskstats.c:412
412 static int cgroupstats_user_cmd(struct sk_buff *skb, struct genl_info
*info)
413 {
414 int rc = 0;
...
436 if (rc < 0)
437 goto err;
438
439 na = nla_reserve(rep_skb, CGROUPSTATS_TYPE_CGROUP_STATS,
440 sizeof(struct cgroupstats));
441 stats = nla_data(na);
442 memset(stats, 0, sizeof(*stats));
443 ...
454 return rc;
455 }
Generally, the return value of nla_reserve() shall be checked against NULL ,
like the following code snippets in function generate_netlink_event().
generate_netlink_event @ drivers/thermal/thermal_sys.c:1227
1227 int generate_netlink_event(u32 orig, enum events event)
1228 {
1229 struct sk_buff *skb;
1230 struct nlattr *attr;
1231 struct thermal_genl_event *thermal_event;
...
1254 attr = nla_reserve(skb, THERMAL_GENL_ATTR_EVENT, \
1255 sizeof(struct thermal_genl_event));
1256
1257 if (!attr) {
1258 nlmsg_free(skb);
1259 return -EINVAL;
1260 }
1261
1262 thermal_event = nla_data(attr);
1263 if (!thermal_event) {
1264 nlmsg_free(skb);
1265 return -EINVAL;
1266 }
...
1285 }
the above suspect bug exists Function reset_per_cpu_data() too.
Thak you!
RUC_Soft_Sec, supported by China.X.Orion
--
You are receiving this mail because:
You are watching the assignee of the bug.
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
