| Message ID | 20190911164013.27364-1-navid.emamdoost@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v3] nbd_genl_status: null check for nla_nest_start | expand |
On Wed, Sep 11, 2019 at 11:40:12AM -0500, Navid Emamdoost wrote: > nla_nest_start may fail and return NULL. The check is inserted, and > errno is selected based on other call sites within the same source code. > Update: removed extra new line. > v3 Update: added release reply, thanks to Michal Kubecek for pointing > out. > > Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> > --- > drivers/block/nbd.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c > index e21d2ded732b..8a9712181c2a 100644 > --- a/drivers/block/nbd.c > +++ b/drivers/block/nbd.c > @@ -2149,6 +2149,12 @@ static int nbd_genl_status(struct sk_buff *skb, struct genl_info *info) > } > > dev_list = nla_nest_start_noflag(reply, NBD_ATTR_DEVICE_LIST); > + if (!dev_list) { > + nlmsg_free(reply); > + ret = -EMSGSIZE; > + goto out; > + } > + > if (index == -1) { > ret = idr_for_each(&nbd_index_idr, &status_cb, reply); > if (ret) { Reviewed-by: Michal Kubecek <mkubecek@suse.cz>
From: Michal Kubecek <mkubecek@suse.cz>
Hi,
I found that CVE-2019-16089 still exist in upstream kernel.
Does anyone know why this patch was not merged?
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index e21d2ded732b..8a9712181c2a 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -2149,6 +2149,12 @@ static int nbd_genl_status(struct sk_buff *skb, struct genl_info *info) } dev_list = nla_nest_start_noflag(reply, NBD_ATTR_DEVICE_LIST); + if (!dev_list) { + nlmsg_free(reply); + ret = -EMSGSIZE; + goto out; + } + if (index == -1) { ret = idr_for_each(&nbd_index_idr, &status_cb, reply); if (ret) {
nla_nest_start may fail and return NULL. The check is inserted, and errno is selected based on other call sites within the same source code. Update: removed extra new line. v3 Update: added release reply, thanks to Michal Kubecek for pointing out. Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> --- drivers/block/nbd.c | 6 ++++++ 1 file changed, 6 insertions(+)