[net,0/3] amt: fix several bugs in amt_rcv()

Message

Taehee Yoo June 2, 2022, 2:01 p.m. UTC

This series fixes bugs in amt_rcv().

First patch fixes pskb_may_pull() issue.
Some functions missed to call pskb_may_pull() and uses wrong
parameter of pskb_may_pull().

Second patch fixes possible null-ptr-deref in amt_rcv().
If there is no amt private data in sock, skb will be freed.
And it increases stats.
But in order to increase stats, amt private data is needed.
So, uninitialised pointer will be used at that point.

Third patch fixes wrong definition of type_str[] in amt.c

Taehee Yoo (3):
  amt: fix wrong usage of pskb_may_pull()
  amt: fix possible null-ptr-deref in amt_rcv()
  amt: fix wrong type string definition

 drivers/net/amt.c | 59 ++++++++++++++++++++++++++++++++---------------
 1 file changed, 40 insertions(+), 19 deletions(-)

Comments

[e-mail] June 6, 2022, 10:04 p.m. UTC | #1

Hello:

This series was applied to netdev/net.git (master)
by Jakub Kicinski <[e-mail]>:

On Thu,  2 Jun 2022 14:01:05 +0000 you wrote:
> This series fixes bugs in amt_rcv().
> 
> First patch fixes pskb_may_pull() issue.
> Some functions missed to call pskb_may_pull() and uses wrong
> parameter of pskb_may_pull().
> 
> Second patch fixes possible null-ptr-deref in amt_rcv().
> If there is no amt private data in sock, skb will be freed.
> And it increases stats.
> But in order to increase stats, amt private data is needed.
> So, uninitialised pointer will be used at that point.
> 
> [...]

Here is the summary with links:
  - [net,1/3] amt: fix wrong usage of pskb_may_pull()
    https://git.kernel.org/netdev/net/c/f55a07074fdd
  - [net,2/3] amt: fix possible null-ptr-deref in amt_rcv()
    https://git.kernel.org/netdev/net/c/d16207f92a4a
  - [net,3/3] amt: fix wrong type string definition
    https://git.kernel.org/netdev/net/c/d7970039d87c

You are awesome, thank you!