New: Missing NULL check of the return value of get_skb() in function send_flowc()

https://bugzilla.kernel.org/show_bug.cgi?id=44631

           Summary: Missing NULL check of the return value of get_skb() in
                    function send_flowc()
           Product: Drivers
           Version: 2.5
    Kernel Version: 2.6.39
          Platform: All
        OS/Version: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: Infiniband/RDMA
        AssignedTo: drivers_infiniband-rdma-ztI5WcYan/[email protected]
        ReportedBy: [email protected]
        Regression: No

Function get_skb() may return a NULL pointer, and its return value shall be checked before used. But in function send_flowc() after get_skb() is called(at drivers/infiniband/hw/cxgb4/cm.c:362), the return value is immediately used as a parameter of __skb_put() without NULL check. Besides, there is no check before the parameter is dereferenced in the callee function __skb_put(). So an invalid memory access may be triggered.
The related code snippets in send_flowc() are as following. send_flowc() @@drivers/infiniband/hw/cxgb4/cm.c:362
362 skb = get_skb(skb, flowclen, GFP_KERNEL);
363 flowc = (struct fw_flowc_wr *)__skb_put(skb, flowclen);

And the implementation of get_skb() are as following.
get_skb() drivers/infiniband/hw/cxgb4/cm.c:301
301static struct sk_buff *get_skb(struct sk_buff *skb, int len, gfp_t gfp) 302{
303 if (skb && !skb_is_nonlinear(skb) && !skb_cloned(skb)) {

 304                skb_trim(skb, 0);
 305                skb_get(skb);
 306                skb_reset_transport_header(skb);

307 } else {
308 skb = alloc_skb(len, gfp);
309 }
310 return skb;
311}

Following is a call instance of snd_flowc.

act_establish @@drivers/infiniband/hw/cxgb4/cm.c:695
 695        /* start MPA negotiation */
 696        send_flowc(ep, NULL);

So from the source code we can see that potential NULL dereference fault exists when path act_establish()->send_flowc()->get_skb()->alloc_skb() is executed.

Thank you

RUC_Soft_Sec

Configure bugmail: https://bugzilla.kernel.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html