From: Florian Westphal Date: Fri, 30 Aug 2024 14:39:10 +0000 (+0200) Subject: xfrm: policy: fix null dereference X-Git-Tag: v6.12-rc1~232^2~45^2~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6a13f5afd39d17320316dbb8dd533fe7c6a613e6;p=thirdparty%2Fkernel%2Flinux.git xfrm: policy: fix null dereference Julian Wiedmann says: > + if (!xfrm_pol_hold_rcu(ret)) Coverity spotted that ^^^ needs a s/ret/pol fix-up: > CID 1599386: Null pointer dereferences (FORWARD_NULL) > Passing null pointer "ret" to "xfrm_pol_hold_rcu", which dereferences it. Ditch the bogus 'ret' variable. Fixes: 563d5ca93e88 ("xfrm: switch migrate to xfrm_policy_lookup_bytype") Reported-by: Julian Wiedmann Closes: https://lore.kernel.org/netdev/06dc2499-c095-4bd4-aee3-a1d0e3ec87c4@gmail.com/ Signed-off-by: Florian Westphal Reviewed-by: Simon Horman Signed-off-by: Steffen Klassert --- diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 6336baa8a93c5..31c14457fdaf1 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -4429,7 +4429,7 @@ EXPORT_SYMBOL_GPL(xfrm_audit_policy_delete); static struct xfrm_policy *xfrm_migrate_policy_find(const struct xfrm_selector *sel, u8 dir, u8 type, struct net *net, u32 if_id) { - struct xfrm_policy *pol, *ret = NULL; + struct xfrm_policy *pol; struct flowi fl; memset(&fl, 0, sizeof(fl)); @@ -4465,7 +4465,7 @@ static struct xfrm_policy *xfrm_migrate_policy_find(const struct xfrm_selector * if (IS_ERR_OR_NULL(pol)) goto out_unlock; - if (!xfrm_pol_hold_rcu(ret)) + if (!xfrm_pol_hold_rcu(pol)) pol = NULL; out_unlock: rcu_read_unlock();