From patchwork Fri Feb 9 06:37:02 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Gustavo A. R. Silva" X-Patchwork-Id: 10208327 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 696B460247 for ; Fri, 9 Feb 2018 07:00:25 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 57B62295B6 for ; Fri, 9 Feb 2018 07:00:25 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4C732296B6; Fri, 9 Feb 2018 07:00:25 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7E52B295B6 for ; Fri, 9 Feb 2018 07:00:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752484AbeBIHAV (ORCPT ); Fri, 9 Feb 2018 02:00:21 -0500 Received: from gateway34.websitewelcome.com ([192.185.148.214]:35525 "EHLO gateway34.websitewelcome.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751052AbeBIHAU (ORCPT ); Fri, 9 Feb 2018 02:00:20 -0500 X-Greylist: delayed 1395 seconds by postgrey-1.27 at vger.kernel.org; Fri, 09 Feb 2018 02:00:20 EST Received: from cm13.websitewelcome.com (cm13.websitewelcome.com [100.42.49.6]) by gateway34.websitewelcome.com (Postfix) with ESMTP id 6690A11401 for ; Fri, 9 Feb 2018 00:37:04 -0600 (CST) Received: from gator4166.hostgator.com ([108.167.133.22]) by cmsmtp with SMTP id k2IyetrrOBUMKk2IyewiLf; Fri, 09 Feb 2018 00:37:04 -0600 Received: from [189.175.4.238] (port=44932 helo=embeddedgus) by gator4166.hostgator.com with esmtpa (Exim 4.89_1) (envelope-from ) id 1ek2Ix-002htd-Va; Fri, 09 Feb 2018 00:37:04 -0600 Date: Fri, 9 Feb 2018 00:37:02 -0600 From: "Gustavo A. R. Silva" To: Doug Ledford , Jason Gunthorpe Cc: linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org, "Gustavo A. R. Silva" Subject: [PATCH] RDMA/nldev: Fix multiple potential NULL pointer dereferences Message-ID: <20180209063702.GA28685@embeddedgus> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.24 (2015-08-30) X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator4166.hostgator.com X-AntiAbuse: Original Domain - vger.kernel.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - embeddedor.com X-BWhitelist: no X-Source-IP: 189.175.4.238 X-Source-L: No X-Exim-ID: 1ek2Ix-002htd-Va X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (embeddedgus) [189.175.4.238]:44932 X-Source-Auth: gustavo@embeddedor.com X-Email-Count: 3 X-Source-Cap: Z3V6aWRpbmU7Z3V6aWRpbmU7Z2F0b3I0MTY2Lmhvc3RnYXRvci5jb20= X-Local-Domain: yes Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP In case the message header and payload cannot be stored, function nlmsg_put returns null. Fix this by adding multiple sanity checks and avoid a potential null dereference on _nlh_ when calling nlmsg_end. Addresses-Coverity-ID: 1454215 ("Dereference null return value") Addresses-Coverity-ID: 1454223 ("Dereference null return value") Addresses-Coverity-ID: 1454224 ("Dereference null return value") Addresses-Coverity-ID: 1464669 ("Dereference null return value") Addresses-Coverity-ID: 1464670 ("Dereference null return value") Addresses-Coverity-ID: 1464672 ("Dereference null return value") Fixes: e5c9469efcb1 ("RDMA/netlink: Add nldev device doit implementation") Fixes: c3f66f7b0052 ("RDMA/netlink: Implement nldev port doit callback") Fixes: 7d02f605f0dc ("RDMA/netlink: Add nldev port dumpit implementation") Fixes: b5fa635aab8f ("RDMA/nldev: Provide detailed QP information") Fixes: bf3c5a93c523 ("RDMA/nldev: Provide global resource utilization") Signed-off-by: Gustavo A. R. Silva --- drivers/infiniband/core/nldev.c | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c index 5326a68..dc8f6eb 100644 --- a/drivers/infiniband/core/nldev.c +++ b/drivers/infiniband/core/nldev.c @@ -313,6 +313,11 @@ static int nldev_get_doit(struct sk_buff *skb, struct nlmsghdr *nlh, nlh = nlmsg_put(msg, NETLINK_CB(skb).portid, nlh->nlmsg_seq, RDMA_NL_GET_TYPE(RDMA_NL_NLDEV, RDMA_NLDEV_CMD_GET), 0, 0); + if (!nlh) { + err = -EMSGSIZE; + goto err_free; + + } err = fill_dev_info(msg, device); if (err) @@ -344,6 +349,8 @@ static int _nldev_get_dumpit(struct ib_device *device, nlh = nlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq, RDMA_NL_GET_TYPE(RDMA_NL_NLDEV, RDMA_NLDEV_CMD_GET), 0, NLM_F_MULTI); + if (!nlh) + goto out; if (fill_dev_info(skb, device)) { nlmsg_cancel(skb, nlh); @@ -354,7 +361,8 @@ static int _nldev_get_dumpit(struct ib_device *device, idx++; -out: cb->args[0] = idx; +out: + cb->args[0] = idx; return skb->len; } @@ -404,6 +412,10 @@ static int nldev_port_get_doit(struct sk_buff *skb, struct nlmsghdr *nlh, nlh = nlmsg_put(msg, NETLINK_CB(skb).portid, nlh->nlmsg_seq, RDMA_NL_GET_TYPE(RDMA_NL_NLDEV, RDMA_NLDEV_CMD_GET), 0, 0); + if (!nlh) { + err = -EMSGSIZE; + goto err_free; + } err = fill_port_info(msg, device, port); if (err) @@ -464,6 +476,8 @@ static int nldev_port_get_dumpit(struct sk_buff *skb, RDMA_NL_GET_TYPE(RDMA_NL_NLDEV, RDMA_NLDEV_CMD_PORT_GET), 0, NLM_F_MULTI); + if (!nlh) + goto out; if (fill_port_info(skb, device, p)) { nlmsg_cancel(skb, nlh); @@ -507,6 +521,10 @@ static int nldev_res_get_doit(struct sk_buff *skb, struct nlmsghdr *nlh, nlh = nlmsg_put(msg, NETLINK_CB(skb).portid, nlh->nlmsg_seq, RDMA_NL_GET_TYPE(RDMA_NL_NLDEV, RDMA_NLDEV_CMD_RES_GET), 0, 0); + if (!nlh) { + ret = -EMSGSIZE; + goto err_free; + } ret = fill_res_info(msg, device); if (ret) @@ -537,6 +555,8 @@ static int _nldev_res_get_dumpit(struct ib_device *device, nlh = nlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq, RDMA_NL_GET_TYPE(RDMA_NL_NLDEV, RDMA_NLDEV_CMD_RES_GET), 0, NLM_F_MULTI); + if (!nlh) + goto out; if (fill_res_info(skb, device)) { nlmsg_cancel(skb, nlh); @@ -603,6 +623,10 @@ static int nldev_res_get_qp_dumpit(struct sk_buff *skb, nlh = nlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq, RDMA_NL_GET_TYPE(RDMA_NL_NLDEV, RDMA_NLDEV_CMD_RES_QP_GET), 0, NLM_F_MULTI); + if (!nlh) { + ret = -EMSGSIZE; + goto err_index; + } if (fill_nldev_handle(skb, device)) { ret = -EMSGSIZE;