Commit fcd30ae0 authored Sep 24, 2019 by Jonathan Lemon Committed by Daniel Borkmann Sep 25, 2019

bpf/xskmap: Return ERR_PTR for failure case instead of NULL.



When kzalloc() failed, NULL was returned to the caller, which
tested the pointer with IS_ERR(), which didn't match, so the
pointer was used later, resulting in a NULL dereference.

Return ERR_PTR(-ENOMEM) instead of NULL.

Reported-by:  <syzbot+491c1b7565ba9069ecae@syzkaller.appspotmail.com>
Fixes: 0402acd6 ("xsk: remove AF_XDP socket from map when the socket is released")
Signed-off-by: Jonathan Lemon <jonathan.lemon@gmail.com>
Acked-by: Björn Töpel <bjorn.topel@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

parent 8a03222f

kernel/bpf/xskmap.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -37,7 +37,7 @@ static struct xsk_map_node xsk_map_node_alloc(struct xsk_map map,

		node = kzalloc(sizeof(*node), GFP_ATOMIC \| __GFP_NOWARN);
		if (!node)
		return NULL;
		return ERR_PTR(-ENOMEM);

		err = xsk_map_inc(map);
		if (err) {

Admin message