Re: Fix NULL dereference in x25_recvmsg

[Eric Dumazet <eric.dumazet@gmail.com>]

Le mardi 01 novembre 2011 à 21:53 -0400, Dave Jones a écrit :
> commit cb101ed2 in 3.0 introduced a bug in x25_recvmsg()
> When passed bogus junk from userspace, x25->neighbour can be NULL,
> as shown in this oops..
> 

Your patch seems fine but :

Are you sure this bug is not present on previous kernels ?

It seems we had prior to this commit :

skb_pull(skb, x25->neighbour->extended ?
	X25_EXT_MIN_LEN : X25_STD_MIN_LEN);



> Signed-off-by: Dave Jones <davej@redhat.com>
> 
> diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
> index 5f03e4e..291b2e0 100644
> --- a/net/x25/af_x25.c
> +++ b/net/x25/af_x25.c
> @@ -1261,13 +1261,17 @@ static int x25_recvmsg(struct kiocb *iocb, struct socket *sock,
>  	struct x25_sock *x25 = x25_sk(sk);
>  	struct sockaddr_x25 *sx25 = (struct sockaddr_x25 *)msg->msg_name;
>  	size_t copied;
> -	int qbit, header_len = x25->neighbour->extended ?
> -		X25_EXT_MIN_LEN : X25_STD_MIN_LEN;
> -
> +	int qbit, header_len;
>  	struct sk_buff *skb;
>  	unsigned char *asmptr;
>  	int rc = -ENOTCONN;
>  
> +	if (x25->neighbour == NULL)
> +		return rc;
> +
> +	header_len = x25->neighbour->extended ?
> +		X25_EXT_MIN_LEN : X25_STD_MIN_LEN;
> +
>  	lock_sock(sk);