From 7d3fd1efceb433dd9dcfcc7ea35ce9bdd726e8b4 Mon Sep 17 00:00:00 2001 From: Gen Zhang Date: Sun, 9 Jun 2019 15:49:16 +0800 Subject: [PATCH] ipv6_sockglue: Fix a missing-check bug in ip6_ra_control() mainline inclusion from mainline-5.2-rc4 commit 95baa60a0da80a0143e3ddd4d3725758b4513825 category: bugfix bugzilla: 13690 CVE: CVE-2019-12378 ------------------------------------------------- In function ip6_ra_control(), the pointer new_ra is allocated a memory space via kmalloc(). And it is used in the following codes. However, when there is a memory allocation error, kmalloc() fails. Thus null pointer dereference may happen. And it will cause the kernel to crash. Therefore, we should check the return value and handle the error. Signed-off-by: Gen Zhang Signed-off-by: David S. Miller Signed-off-by: Yang Yingliang Reviewed-by: Yue Haibing Signed-off-by: Yang Yingliang --- net/ipv6/ipv6_sockglue.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index f3e99e578843..a82d35cf317a 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -68,6 +68,8 @@ int ip6_ra_control(struct sock *sk, int sel) return -ENOPROTOOPT; new_ra = (sel >= 0) ? kmalloc(sizeof(*new_ra), GFP_KERNEL) : NULL; + if (sel >= 0 && !new_ra) + return -ENOMEM; write_lock_bh(&ip6_ra_lock); for (rap = &ip6_ra_chain; (ra = *rap) != NULL; rap = &ra->next) { -- GitLab