[v1] ipv6/sit: fix ipip6_tunnel_get_prl when memory allocation fails

[PATCH] ipv6/sit: fix ipip6_tunnel_get_prl when memory allocation fails

Posted by zys.zljxml@gmail.com 3 years, 9 months ago

From: katrinzhou <katrinzhou@tencent.com>

Fix an illegal copy_to_user() attempt when the system fails to
allocate memory for prl due to a lack of memory.

Addresses-Coverity: ("Unused value")
Fixes: 300aaeeaab5f ("[IPV6] SIT: Add SIOCGETPRL ioctl to get/dump PRL.")
Signed-off-by: katrinzhou <katrinzhou@tencent.com>
---
 net/ipv6/sit.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index c0b138c20992..4fb84c0b30be 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -323,8 +323,6 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
 		kcalloc(cmax, sizeof(*kp), GFP_KERNEL_ACCOUNT | __GFP_NOWARN) :
 		NULL;
 
-	rcu_read_lock();
-
 	ca = min(t->prl_count, cmax);
 
 	if (!kp) {
@@ -337,11 +335,12 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
 					      __GFP_NOWARN);
 		if (!kp) {
 			ret = -ENOMEM;
-			goto out;
+			goto err;
 		}
 	}
 
 	c = 0;
+	rcu_read_lock();
 	for_each_prl_rcu(t->prl) {
 		if (c >= cmax)
 			break;
@@ -362,7 +361,7 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
 		ret = -EFAULT;
 
 	kfree(kp);
-
+err:
 	return ret;
 }
 
-- 
2.27.0

Re: [PATCH] ipv6/sit: fix ipip6_tunnel_get_prl when memory allocation fails

Posted by David Ahern 3 years, 9 months ago

On 6/24/22 2:12 AM, zys.zljxml@gmail.com wrote:
> diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
> index c0b138c20992..4fb84c0b30be 100644
> --- a/net/ipv6/sit.c
> +++ b/net/ipv6/sit.c
> @@ -323,8 +323,6 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
>  		kcalloc(cmax, sizeof(*kp), GFP_KERNEL_ACCOUNT | __GFP_NOWARN) :
>  		NULL;
>  
> -	rcu_read_lock();
> -
>  	ca = min(t->prl_count, cmax);
>  
>  	if (!kp) {
> @@ -337,11 +335,12 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
>  					      __GFP_NOWARN);
>  		if (!kp) {
>  			ret = -ENOMEM;
> -			goto out;
> +			goto err;
>  		}
>  	}
>  
>  	c = 0;
> +	rcu_read_lock();
>  	for_each_prl_rcu(t->prl) {
>  		if (c >= cmax)
>  			break;
> @@ -362,7 +361,7 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
>  		ret = -EFAULT;
>  
>  	kfree(kp);
> -
> +err:
>  	return ret;
>  }
>  

'out' label is no longer used and should be removed.

Re: [PATCH] ipv6/sit: fix ipip6_tunnel_get_prl when memory allocation fails

Posted by Katrin Jo 3 years, 9 months ago

On Fri, Jun 24, 2022 at 11:12 PM David Ahern <dsahern@kernel.org> wrote:
>
> On 6/24/22 2:12 AM, zys.zljxml@gmail.com wrote:
> > diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
> > index c0b138c20992..4fb84c0b30be 100644
> > --- a/net/ipv6/sit.c
> > +++ b/net/ipv6/sit.c
> > @@ -323,8 +323,6 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> >               kcalloc(cmax, sizeof(*kp), GFP_KERNEL_ACCOUNT | __GFP_NOWARN) :
> >               NULL;
> >
> > -     rcu_read_lock();
> > -
> >       ca = min(t->prl_count, cmax);
> >
> >       if (!kp) {
> > @@ -337,11 +335,12 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> >                                             __GFP_NOWARN);
> >               if (!kp) {
> >                       ret = -ENOMEM;
> > -                     goto out;
> > +                     goto err;
> >               }
> >       }
> >
> >       c = 0;
> > +     rcu_read_lock();
> >       for_each_prl_rcu(t->prl) {
> >               if (c >= cmax)
> >                       break;
> > @@ -362,7 +361,7 @@ static int ipip6_tunnel_get_prl(struct net_device *dev, struct ip_tunnel_prl __u
> >               ret = -EFAULT;
> >
> >       kfree(kp);
> > -
> > +err:
> >       return ret;
> >  }
> >
>
> 'out' label is no longer used and should be removed.

Thanks for reviewing! I sent the V2 patch, modified according to your
suggestion.
The label is removed, and I still use the label "out" instead of "err".

Best Regards,
Katrin