Skip to contentSkip to conversation

VXLAN: fix potential NULL dereference in arp_reduce()

PATCH Applied David L Stevens 3 participants 5 messages Mar 18, 2014

Subsystems (2)
Networking Network drivers
lore
Share & tools
lore

David L Stevens

author
#0 lore raw

PATCH 1/1 VXLAN: fix potential NULL dereference in arp_reduce()

This patch fixes a NULL pointer dereference in the event of an
skb allocation failure in arp_reduce().

Signed-off-by David L Stevens <[email protected]>
drivers/net/vxlan.c +3 -0
index eb59b14..570792c 100644
@@ -1315,6 +1315,9 @@ static int arp_reduce(struct net_device *dev, struct sk_buff *skb)
 
 		neigh_release(n);
 
+		if (reply == NULL)
+			goto out;
+
 		skb_reset_mac_header(reply);
 		__skb_pull(reply, skb_network_offset(reply));
 		reply->ip_summed = CHECKSUM_UNNECESSARY;
Acked-by on v1 1/1
#1 lore raw
Quoted 11 lines · David L Stevens

This patch fixes a NULL pointer dereference in the event of an
skb allocation failure in arp_reduce().

Signed-off-by David L Stevens <[email protected]>
drivers/net/vxlan.c +0 -0
index eb59b14..570792c 100644

drivers/net/vxlan.c static int arp_reduce(struct net_device *dev, struct sk_buff *skb) · line 1320

Quoted 6 lines
drivers/net/vxlan.c +3 -0
@@ -1315,6 +1315,9 @@ static int arp_reduce(struct net_device *dev, struct sk_buff *skb)
 
                neigh_release(n);
 
+               if (reply == NULL)
+                       goto out;
+

Nit: move it right after arp_create(). Otherwise:

Acked-by Cong Wang <[email protected]>
author
#2 lore raw
Quoted 7 lines

From: Cong Wang

Nit: move it right after arp_create(). Otherwise:

That would exit without releasing the neighbor reference.

                                                   +-DLS

#3 lore raw
Quoted 10 lines · David Stevens
Quoted 7 lines

From: Cong Wang

Nit: move it right after arp_create(). Otherwise:

That would exit without releasing the neighbor reference.

Ah, then it's ok.