Re: [PATCH linux-next] ipv4: Fix NULL deference in fnhe_remove_oldest()
From: Eric Dumazet <edumazet@google.com>
Date: 2021-09-02 16:38:44
Also in:
lkml
On Thu, Sep 2, 2021 at 9:32 AM Tim Gardner [off-list ref] wrote:
Coverity complains that linux-next commit 67d6d681e15b5 ("ipv4: make
exception cache less predictible") neglected to check for NULL before
dereferencing 'oldest'. It appears to be possible to fall through the for
loop without ever setting 'oldest'.Coverity is wrong. fnhe_remove_oldest() is only called when there are at least 6 items in the list. There is no way oldest could be NULL, or that oldest_p could contain garbage.
quoted hunk ↗ jump to hunk
Cc: Eric Dumazet <edumazet@google.com> Cc: "David S. Miller" <davem@davemloft.net> Cc: Hideaki YOSHIFUJI <redacted> Cc: David Ahern <dsahern@kernel.org> Cc: Jakub Kicinski <kuba@kernel.org> Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Tim Gardner <redacted> --- net/ipv4/route.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)diff --git a/net/ipv4/route.c b/net/ipv4/route.c index d6899ab5fb39..e85026591a09 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c@@ -603,9 +603,11 @@ static void fnhe_remove_oldest(struct fnhe_hash_bucket *hash) oldest_p = fnhe_p; } } - fnhe_flush_routes(oldest); - *oldest_p = oldest->fnhe_next; - kfree_rcu(oldest, rcu); + if (oldest) { + fnhe_flush_routes(oldest); + *oldest_p = oldest->fnhe_next; + kfree_rcu(oldest, rcu); + } } static u32 fnhe_hashfun(__be32 daddr) --2.33.0