diff mbox series

ipv6/sit: fix ipip6_tunnel_get_prl when memory allocation fails

Message ID 20220624081254.1251316-1-zys.zljxml@gmail.com (mailing list archive)
State Superseded
Delegated to: Netdev Maintainers
Headers show
Series ipv6/sit: fix ipip6_tunnel_get_prl when memory allocation fails | expand

Checks

Context Check Description
netdev/tree_selection success Guessed tree name to be net-next
netdev/fixes_present success Fixes tag not required for -next series
netdev/subject_prefix warning Target tree name not specified in the subject
netdev/cover_letter success Single patches do not need cover letters
netdev/patch_count success Link
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit fail Errors and warnings before: 0 this patch: 2
netdev/cc_maintainers success CCed 7 of 7 maintainers
netdev/build_clang fail Errors and warnings before: 0 this patch: 2
netdev/module_param success Was 0 now: 0
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success Fixes tag looks correct
netdev/build_allmodconfig_warn fail Errors and warnings before: 0 this patch: 2
netdev/checkpatch success total: 0 errors, 0 warnings, 0 checks, 29 lines checked
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0

Commit Message

Katrin Jo June 24, 2022, 8:12 a.m. UTC 
From: katrinzhou <katrinzhou@tencent.com>

Fix an illegal copy_to_user() attempt when the system fails to
allocate memory for prl due to a lack of memory.

Addresses-Coverity: ("Unused value")
Fixes: 300aaeeaab5f ("[IPV6] SIT: Add SIOCGETPRL ioctl to get/dump PRL.")
Signed-off-by: katrinzhou <katrinzhou@tencent.com>
---
 net/ipv6/sit.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

Comments

David Ahern June 24, 2022, 3:12 p.m. UTC | #1 
On 6/24/22 2:12 AM, zys.zljxml@gmail.com wrote:
> diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
> index c0b138c20992..4fb84c0b30be 100644
> --- a/net/ipv6/sit.c
> +++ b/net/ipv6/sit.c
> @@ -323,8 +323,6 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
>  		kcalloc(cmax, sizeof(*kp), GFP_KERNEL_ACCOUNT | __GFP_NOWARN) :
>  		NULL;
>  
> -	rcu_read_lock();
> -
>  	ca = min(t->prl_count, cmax);
>  
>  	if (!kp) {
> @@ -337,11 +335,12 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
>  					      __GFP_NOWARN);
>  		if (!kp) {
>  			ret = -ENOMEM;
> -			goto out;
> +			goto err;
>  		}
>  	}
>  
>  	c = 0;
> +	rcu_read_lock();
>  	for_each_prl_rcu(t->prl) {
>  		if (c >= cmax)
>  			break;
> @@ -362,7 +361,7 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
>  		ret = -EFAULT;
>  
>  	kfree(kp);
> -
> +err:
>  	return ret;
>  }
>  

'out' label is no longer used and should be removed.
Katrin Jo June 25, 2022, 5:48 a.m. UTC | #2 
On Fri, Jun 24, 2022 at 11:12 PM David Ahern <dsahern@kernel.org> wrote:
>
> On 6/24/22 2:12 AM, zys.zljxml@gmail.com wrote:
> > diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
> > index c0b138c20992..4fb84c0b30be 100644
> > --- a/net/ipv6/sit.c
> > +++ b/net/ipv6/sit.c
> > @@ -323,8 +323,6 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> >               kcalloc(cmax, sizeof(*kp), GFP_KERNEL_ACCOUNT | __GFP_NOWARN) :
> >               NULL;
> >
> > -     rcu_read_lock();
> > -
> >       ca = min(t->prl_count, cmax);
> >
> >       if (!kp) {
> > @@ -337,11 +335,12 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> >                                             __GFP_NOWARN);
> >               if (!kp) {
> >                       ret = -ENOMEM;
> > -                     goto out;
> > +                     goto err;
> >               }
> >       }
> >
> >       c = 0;
> > +     rcu_read_lock();
> >       for_each_prl_rcu(t->prl) {
> >               if (c >= cmax)
> >                       break;
> > @@ -362,7 +361,7 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> >               ret = -EFAULT;
> >
> >       kfree(kp);
> > -
> > +err:
> >       return ret;
> >  }
> >
>
> 'out' label is no longer used and should be removed.

Thanks for reviewing! I sent the V2 patch, modified according to your
suggestion.
The label is removed, and I still use the label "out" instead of "err".

Best Regards,
Katrin
diff mbox series

Patch

diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index c0b138c20992..4fb84c0b30be 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -323,8 +323,6 @@  static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
 		kcalloc(cmax, sizeof(*kp), GFP_KERNEL_ACCOUNT | __GFP_NOWARN) :
 		NULL;
 
-	rcu_read_lock();
-
 	ca = min(t->prl_count, cmax);
 
 	if (!kp) {
@@ -337,11 +335,12 @@  static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
 					      __GFP_NOWARN);
 		if (!kp) {
 			ret = -ENOMEM;
-			goto out;
+			goto err;
 		}
 	}
 
 	c = 0;
+	rcu_read_lock();
 	for_each_prl_rcu(t->prl) {
 		if (c >= cmax)
 			break;
@@ -362,7 +361,7 @@  static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
 		ret = -EFAULT;
 
 	kfree(kp);
-
+err:
 	return ret;
 }