From a9c9a1cefbb681405555ac7899a4b8b83fd8100b Mon Sep 17 00:00:00 2001 From: Navid Emamdoost Date: Tue, 25 Aug 2020 11:23:51 +0800 Subject: [PATCH] nbd_genl_status: null check for nla_nest_start hulk inclusion category: bugfix bugzilla: NA CVE: CVE-2019-16089 --------------------------- nla_nest_start may fail and return NULL. The check is inserted, and errno is selected based on other call sites within the same source code. Update: removed extra new line. v3 Update: added release reply, thanks to Michal Kubecek for pointing out. Signed-off-by: Navid Emamdoost Reviewed-by: Michal Kubecek Signed-off-by: Yang Yingliang Reviewed-by: Jason Yan Signed-off-by: Yang Yingliang --- drivers/block/nbd.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index a7e7820674a4..816188aa841f 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -2220,6 +2220,12 @@ static int nbd_genl_status(struct sk_buff *skb, struct genl_info *info) } dev_list = nla_nest_start(reply, NBD_ATTR_DEVICE_LIST); + if (!dev_list) { + nlmsg_free(reply); + ret = -EMSGSIZE; + goto out; + } + if (index == -1) { ret = idr_for_each(&nbd_index_idr, &status_cb, reply); if (ret) { -- GitLab