[PATCH AUTOSEL 5.13 13/14] net: fix NULL pointer reference in cipso_v4_doi_free

From: 王贇 <redacted>

[ Upstream commit 733c99ee8be9a1410287cdbb943887365e83b2d6 ]

In netlbl_cipsov4_add_std() when 'doi_def->map.std' alloc
failed, we sometime observe panic:

  BUG: kernel NULL pointer dereference, address:
  ...
  RIP: 0010:cipso_v4_doi_free+0x3a/0x80
  ...
  Call Trace:
   netlbl_cipsov4_add_std+0xf4/0x8c0
   netlbl_cipsov4_add+0x13f/0x1b0
   genl_family_rcv_msg_doit.isra.15+0x132/0x170
   genl_rcv_msg+0x125/0x240

This is because in cipso_v4_doi_free() there is no check
on 'doi_def->map.std' when 'doi_def->type' equal 1, which
is possibe, since netlbl_cipsov4_add_std() haven't initialize
it before alloc 'doi_def->map.std'.

This patch just add the check to prevent panic happen for similar
cases.

Reported-by: Abaci <redacted>
Signed-off-by: Michael Wang <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/cipso_ipv4.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index e0480c6cebaa..16bbd62db791 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c

@@ -466,14 +466,16 @@ void cipso_v4_doi_free(struct cipso_v4_doi *doi_def)
 	if (!doi_def)
 		return;
 
-	switch (doi_def->type) {
-	case CIPSO_V4_MAP_TRANS:
-		kfree(doi_def->map.std->lvl.cipso);
-		kfree(doi_def->map.std->lvl.local);
-		kfree(doi_def->map.std->cat.cipso);
-		kfree(doi_def->map.std->cat.local);
-		kfree(doi_def->map.std);
-		break;
+	if (doi_def->map.std) {
+		switch (doi_def->type) {
+		case CIPSO_V4_MAP_TRANS:
+			kfree(doi_def->map.std->lvl.cipso);
+			kfree(doi_def->map.std->lvl.local);
+			kfree(doi_def->map.std->cat.cipso);
+			kfree(doi_def->map.std->cat.local);
+			kfree(doi_def->map.std);
+			break;
+		}
 	}
 	kfree(doi_def);
 }

-- 
2.30.2

On Mon, Aug 30, 2021 at 8:01 PM Sasha Levin [off-list ref] wrote:

From: 王贇 <redacted>

[ Upstream commit 733c99ee8be9a1410287cdbb943887365e83b2d6 ]

Hi Sasha,

Michael Wang has sent a v2 patch [1] for this bug and it is merged
into netdev/net-next.git. However, the v1 patch is already in the
upstream tree.

How do you guys handle such a issue?

[1] https://lkml.org/lkml/2021/8/30/229

On Mon, Aug 30, 2021 at 8:42 AM Dongliang Mu [off-list ref] wrote:

On Mon, Aug 30, 2021 at 8:01 PM Sasha Levin [off-list ref] wrote:

quoted

From: 王贇 <redacted>

[ Upstream commit 733c99ee8be9a1410287cdbb943887365e83b2d6 ]

Hi Sasha,

Michael Wang has sent a v2 patch [1] for this bug and it is merged
into netdev/net-next.git. However, the v1 patch is already in the
upstream tree.

How do you guys handle such a issue?

[1] https://lkml.org/lkml/2021/8/30/229

Ugh.  Michael can you please work with netdev to fix this in the
upstream, and hopefully -stable, kernels?  My guess is you will need
to rebase your v2 patch on top of the v1 patch (basically what exists
in upstream) and send that back out.

-- 
paul moore
www.paul-moore.com

On Mon, Aug 30, 2021 at 10:20:22AM -0400, Paul Moore wrote:

On Mon, Aug 30, 2021 at 8:42 AM Dongliang Mu [off-list ref] wrote:

quoted

On Mon, Aug 30, 2021 at 8:01 PM Sasha Levin [off-list ref] wrote:

quoted

From: 王贇 <redacted>

[ Upstream commit 733c99ee8be9a1410287cdbb943887365e83b2d6 ]

Hi Sasha,

Michael Wang has sent a v2 patch [1] for this bug and it is merged
into netdev/net-next.git. However, the v1 patch is already in the
upstream tree.

How do you guys handle such a issue?

[1] https://lkml.org/lkml/2021/8/30/229

Ugh.  Michael can you please work with netdev to fix this in the
upstream, and hopefully -stable, kernels?  My guess is you will need
to rebase your v2 patch on top of the v1 patch (basically what exists
in upstream) and send that back out.

I'm just going to drop this one for now (it never made it in). If there
is a follow-up you do want us to queue please let us know :)

-- 
Thanks,
Sasha

On Sun, Sep 5, 2021 at 8:54 AM Sasha Levin [off-list ref] wrote:

On Mon, Aug 30, 2021 at 10:20:22AM -0400, Paul Moore wrote:

quoted

On Mon, Aug 30, 2021 at 8:42 AM Dongliang Mu [off-list ref] wrote:

quoted

On Mon, Aug 30, 2021 at 8:01 PM Sasha Levin [off-list ref] wrote:

quoted

From: 王贇 <redacted>

[ Upstream commit 733c99ee8be9a1410287cdbb943887365e83b2d6 ]

Hi Sasha,

Michael Wang has sent a v2 patch [1] for this bug and it is merged
into netdev/net-next.git. However, the v1 patch is already in the
upstream tree.

How do you guys handle such a issue?

[1] https://lkml.org/lkml/2021/8/30/229

Ugh.  Michael can you please work with netdev to fix this in the
upstream, and hopefully -stable, kernels?  My guess is you will need
to rebase your v2 patch on top of the v1 patch (basically what exists
in upstream) and send that back out.

I'm just going to drop this one for now (it never made it in). If there
is a follow-up you do want us to queue please let us know :)

Thanks Sasha.  The lore link below is the v2 version of the patch and
it is worth merging as a fix into the older kernels.

* https://lore.kernel.org/linux-security-module/18f0171e-0cc8-6ae6-d04a-a69a2a3c1a39@linux.alibaba.com

-- 
paul moore
www.paul-moore.com