> On Wed, 2018-10-10 at 18:11 +0000, justin.l...@dell.com wrote:
> <snip>
> > +
> > + len = nla_len(info->attrs[NCSI_ATTR_DATA]);
> > + if (len < sizeof(struct ncsi_pkt_hdr)) {
> > + netdev_info(ndp->ndev.dev, "NCSI: no command to send %u\n",
> > + package_id);
> > + ret = -EINVAL;
> > + goto out_netlink;
> > + } else {
> > + data = (unsigned char *)nla_data(info->attrs[NCSI_ATTR_DATA]);
> > + }
>
> I only just noticed this, the call to nla_len() can cause a null-dereference
> if
> the NCSI_ATTR_DATA attribute isn't present; we need to make sure it exists
> before accessing it in info->attrs.
>
> eg:
>
> root@ozrom2-bmc:~# ./ncsi-netlink -l 2 -p 0 -c 0 --cmd
> [ 81.399837] Unable to handle kernel NULL pointer dereference at virtual
> address 00000000
> [ 81.409092] pgd = ddaa9fa6
> [ 81.413084] [00000000] *pgd=9702c831, *pte=00000000, *ppte=00000000
> [ 81.420729] Internal error: Oops: 17 [#1] ARM
> [ 81.426447] CPU: 0 PID: 1028 Comm: ncsi-netlink Not tainted
> 4.18.8-sammj-00144-gbc129f31bfa5 #12
> ...
> [ 81.874434] Kernel panic - not syncing: Fatal exception
>
> Cheers,
> Sam
Good catch! I will address this and generate the new patch.
Thanks,
Justin
