** Description changed:
[Impact]
In the UBUNTU SAUCE VXLAN implementation for fan, in
'vxlan_fan_add_map()' a memory chunk is allocated to hold the a fan_map
structure. However, the return of 'kmalloc()' is not checked, therefore
it can lead to a NULL pointer dereference on allocation failure.
---
static int vxlan_fan_add_map(struct vxlan_dev *vxlan, struct ifla_fan_map
*map)
{
[...]
fan_map = kmalloc(sizeof(*fan_map), GFP_KERNEL);
fan_map->underlay = map->underlay;
---
+
+ The issue was introduced by commit "UBUNTU: SAUCE: fan: add VXLAN
+ implementation".
[Fix]
The fix is a simple check whether the memory allocation failed and
return an error if so. The function doesn't perform any other operation
prior to calling 'kmalloc()' that needs to be rolled back on error,
therefore it can simply return -ENOMEM.
---
fan_map = kmalloc(sizeof(*fan_map), GFP_KERNEL);
+ if (!fan_map)
+ return -ENOMEM;
---
[Test plan]
I have not tested the fix functionally, as the issue is hard to
reproduce. This code path is exercised by the 'ubuntu_fan_smoke_test'
regression tests.
[Where problems could occur]
The fix is straightforward, however if issues are to occur they will
happen while creating new fan interface.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2125053
Title:
UBUNTU: fan: fail to check kmalloc() return could cause a NULL pointer
dereference
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2125053/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
