Re: [regression] nf_iterate(), BUG: unable to handle kernel NULL pointer dereference

Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
From: David Miller
Date: Thursday, July 24, 2008 - 3:09 pm

From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Thu, 24 Jul 2008 14:13:42 -0700 (PDT)


Actually in the old code this precondition didn't hold, which explains
how it is.

The old code looked like:

	if (newlen >= ksize(ct->ext)) {
		new = kmalloc(newlen, gfp);
		if (!new)
			return NULL;
 ...
		ct->ext = new;
	}

	ct->ext->offset[id] = newoff;
	ct->ext->len = newlen;
	memset((void *)ct->ext + newoff, 0, newlen - newoff);
	return (void *)ct->ext + newoff;

and in that context 'new' is only assigned in the "newlen >=" guarded
code block.

Anyways, it does seem that we should indeed only update the
new larger length only after we've initialized the contents.

Note that we could make krealloc() and friends clear out the trailing
bits of the new buffer, and therefore the caller wouldn't even need to
be mindful of such things.

I don't know if that's desirable in general, probably it isn't.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]

Messages in current thread:
[GIT]: Networking, David Miller, (Sun Jul 20, 10:44 am)
Re: [GIT]: Networking, Arjan van de Ven, (Sun Jul 20, 10:59 am)
Re: [GIT]: Networking, David Miller, (Sun Jul 20, 4:52 pm)
Re: [GIT]: Networking, Linus Torvalds, (Sun Jul 20, 5:54 pm)
Re: [GIT]: Networking, David Miller, (Sun Jul 20, 6:03 pm)
Re: [GIT]: Networking, Linus Torvalds, (Sun Jul 20, 6:07 pm)
Re: [GIT]: Networking, Alexey Dobriyan, (Sun Jul 20, 6:09 pm)
Re: [GIT]: Networking, David Miller, (Sun Jul 20, 6:14 pm)
Re: [GIT]: Networking, David Miller, (Sun Jul 20, 6:17 pm)
Re: [GIT]: Networking, Patrick McHardy, (Sun Jul 20, 6:20 pm)
Re: [GIT]: Networking, Alexey Dobriyan, (Sun Jul 20, 6:22 pm)
Re: [GIT]: Networking, Alexey Dobriyan, (Sun Jul 20, 7:40 pm)
Re: [GIT]: Networking, David Miller, (Sun Jul 20, 7:48 pm)
Re: [GIT]: Networking, David Miller, (Sun Jul 20, 10:11 pm)
Re: [GIT]: Networking, Alexander Beregalov, (Mon Jul 21, 2:48 am)
Re: [GIT]: Networking, Ben Hutchings, (Mon Jul 21, 3:16 am)
Re: [GIT]: Networking, Stefan Richter, (Mon Jul 21, 4:28 am)
Re: [GIT]: Networking, James Morris, (Mon Jul 21, 4:45 am)
Re: [GIT]: Networking, Alexey Dobriyan, (Mon Jul 21, 4:57 am)
Re: [GIT]: Networking, Patrick McHardy, (Mon Jul 21, 5:05 am)
Re: [GIT]: Networking, Ingo Molnar, (Mon Jul 21, 6:50 am)
Re: [GIT]: Networking, Stefan Richter, (Mon Jul 21, 7:15 am)
Re: [GIT]: Networking, David Miller, (Mon Jul 21, 8:27 am)
Re: [GIT]: Networking, David Miller, (Mon Jul 21, 8:35 am)
Re: [GIT]: Networking, Alexander Beregalov, (Mon Jul 21, 9:04 am)
Re: [GIT]: Networking, Linus Torvalds, (Mon Jul 21, 9:49 am)
Re: [GIT]: Networking, David Miller, (Mon Jul 21, 9:53 am)
Re: [GIT]: Networking, David Miller, (Mon Jul 21, 10:28 am)
Re: [GIT]: Networking, Linus Torvalds, (Mon Jul 21, 10:40 am)
[crash] kernel BUG at net/core/dev.c:1328!, Ingo Molnar, (Mon Jul 21, 11:23 am)
Re: [crash] kernel BUG at net/core/dev.c:1328!, Linus Torvalds, (Mon Jul 21, 11:35 am)
Re: [crash] kernel BUG at net/core/dev.c:1328!, Ingo Molnar, (Mon Jul 21, 11:46 am)
Re: [crash] kernel BUG at net/core/dev.c:1328!, David Miller, (Mon Jul 21, 12:00 pm)
Re: [crash] kernel BUG at net/core/dev.c:1328!, Stefan Richter, (Mon Jul 21, 12:20 pm)
Re: [crash] kernel BUG at net/core/dev.c:1328!, Ingo Molnar, (Mon Jul 21, 12:30 pm)
Re: [crash] kernel BUG at net/core/dev.c:1328!, Ingo Molnar, (Mon Jul 21, 12:44 pm)
Re: [crash] kernel BUG at net/core/dev.c:1328!, David Miller, (Mon Jul 21, 1:11 pm)
Re: [crash] kernel BUG at net/core/dev.c:1328!, David Miller, (Mon Jul 21, 1:20 pm)
Re: [GIT]: Networking, David Miller, (Mon Jul 21, 1:32 pm)
Re: [GIT]: Networking, Patrick McHardy, (Mon Jul 21, 1:33 pm)
Re: [crash] kernel BUG at net/core/dev.c:1328!, Stefan Richter, (Mon Jul 21, 2:26 pm)
[TCP bug] stuck distcc connections in latest -git, Ingo Molnar, (Tue Jul 22, 4:21 am)
Re: [TCP bug] stuck distcc connections in latest -git, David Newall, (Tue Jul 22, 6:45 am)
Re: [TCP bug] stuck distcc connections in latest -git, Ingo Molnar, (Tue Jul 22, 6:57 am)
Re: [TCP bug] stuck distcc connections in latest -git, David Newall, (Tue Jul 22, 7:54 am)
Re: [TCP bug] stuck distcc connections in latest -git, Ingo Molnar, (Tue Jul 22, 8:34 am)
Re: [TCP bug] stuck distcc connections in latest -git, Willy Tarreau, (Tue Jul 22, 2:12 pm)
Re: [TCP bug] stuck distcc connections in latest -git, Ingo Molnar, (Wed Jul 23, 1:26 am)
Re: [GIT]: Networking, David Miller, (Wed Jul 23, 4:42 pm)
Re: [regression] nf_iterate(), BUG: unable to handle kerne ..., Krzysztof Oledzki, (Thu Jul 24, 11:00 am)
Re: [regression] nf_iterate(), BUG: unable to handle kerne ..., David Miller, (Thu Jul 24, 3:09 pm)