From: Dan Carpenter Date: Wed, 14 Jun 2017 10:35:37 +0000 (+0300) Subject: xfrm: NULL dereference on allocation failure X-Git-Tag: release-20171130_firefly~4^2~100^2^2~2^2~17 X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=ac78351c96e8e58cf93e336ffdf0560a8f691b50;p=firefly-linux-kernel-4.4.55.git xfrm: NULL dereference on allocation failure commit e747f64336fc15e1c823344942923195b800aa1e upstream. The default error code in pfkey_msg2xfrm_state() is -ENOBUFS. We added a new call to security_xfrm_state_alloc() which sets "err" to zero so there several places where we can return ERR_PTR(0) if kmalloc() fails. The caller is expecting error pointers so it leads to a NULL dereference. Fixes: df71837d5024 ("[LSM-IPSec]: Security association restriction.") Signed-off-by: Dan Carpenter Signed-off-by: Steffen Klassert Signed-off-by: Greg Kroah-Hartman --- diff --git a/net/key/af_key.c b/net/key/af_key.c index f9c9ecb0cdd3..4f5992966924 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -1135,6 +1135,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, goto out; } + err = -ENOBUFS; key = ext_hdrs[SADB_EXT_KEY_AUTH - 1]; if (sa->sadb_sa_auth) { int keysize = 0;