[ovs-dev] [PATCH] net: openvswitch: fix missing checks for nla_nest_start

[Kangjie Lu]

nla_nest_start may fail and thus deserves a check.
The fix returns -EMSGSIZE when it fails.

Signed-off-by: Kangjie Lu 
---
 net/openvswitch/datapath.c | 8 
 1 file changed, 8 insertions(+)

diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 45d1469308b0..9dd158ab51b3 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -464,6 +464,10 @@ static int queue_userspace_packet(struct datapath *dp, 
struct sk_buff *skb,
 
if (upcall_info->egress_tun_info) {
nla = nla_nest_start(user_skb, OVS_PACKET_ATTR_EGRESS_TUN_KEY);
+   if (!nla) {
+   err = -EMSGSIZE;
+   goto out;
+   }
err = ovs_nla_put_tunnel_info(user_skb,
  upcall_info->egress_tun_info);
BUG_ON(err);
@@ -472,6 +476,10 @@ static int queue_userspace_packet(struct datapath *dp, 
struct sk_buff *skb,
 
if (upcall_info->actions_len) {
nla = nla_nest_start(user_skb, OVS_PACKET_ATTR_ACTIONS);
+   if (!nla) {
+   err = -EMSGSIZE;
+   goto out;
+   }
err = ovs_nla_put_actions(upcall_info->actions,
  upcall_info->actions_len,
  user_skb);
-- 
2.17.1

___
dev mailing list
d...@openvswitch.org
https://mail.openvswitch.org/mailman/listinfo/ovs-dev

[ovs-dev] [PATCH] net: openvswitch: fix a NULL pointer dereference

[Kangjie Lu]

upcall is dereferenced even when genlmsg_put fails. The fix
goto out to avoid the NULL pointer dereference in this case.

Signed-off-by: Kangjie Lu 
---
 net/openvswitch/datapath.c | 4 
 1 file changed, 4 insertions(+)

diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 6679e96ab1dc..45d1469308b0 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -448,6 +448,10 @@ static int queue_userspace_packet(struct datapath *dp, 
struct sk_buff *skb,
 
upcall = genlmsg_put(user_skb, 0, 0, _packet_genl_family,
 0, upcall_info->cmd);
+   if (!upcall) {
+   err = -EINVAL;
+   goto out;
+   }
upcall->dp_ifindex = dp_ifindex;
 
err = ovs_nla_put_key(key, key, OVS_PACKET_ATTR_KEY, false, user_skb);
-- 
2.17.1

___
dev mailing list
d...@openvswitch.org
https://mail.openvswitch.org/mailman/listinfo/ovs-dev