* [PATCH] caif: Do not dereference NULL in chnl_recv_cb()
@ 2012-08-17 20:33 Jesper Juhl
2012-08-20 6:33 ` Sjur BRENDELAND
0 siblings, 1 reply; 3+ messages in thread
From: Jesper Juhl @ 2012-08-17 20:33 UTC (permalink / raw)
To: linux-kernel; +Cc: netdev, David S. Miller, Sjur Braendeland, Daniel Martensson
In net/caif/chnl_net.c::chnl_recv_cb() we call skb_header_pointer()
which may return NULL, but we do not check for a NULL pointer before
dereferencing it.
This patch adds such a NULL check and properly free's allocated memory
and return an error (-EINVAL) on failure - much better than crashing..
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
---
net/caif/chnl_net.c | 4 ++++
1 file changed, 4 insertions(+)
Note: compile tested only.
diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
index 69771c0..e597733 100644
--- a/net/caif/chnl_net.c
+++ b/net/caif/chnl_net.c
@@ -94,6 +94,10 @@ static int chnl_recv_cb(struct cflayer *layr, struct cfpkt *pkt)
/* check the version of IP */
ip_version = skb_header_pointer(skb, 0, 1, &buf);
+ if (!ip_version) {
+ kfree_skb(skb);
+ return -EINVAL;
+ }
switch (*ip_version >> 4) {
case 4:
--
1.7.11.4
--
Jesper Juhl <jj@chaosbits.net> http://www.chaosbits.net/
Don't top-post http://www.catb.org/jargon/html/T/top-post.html
Plain text mails only, please.
^ permalink raw reply related [flat|nested] 3+ messages in thread* RE: [PATCH] caif: Do not dereference NULL in chnl_recv_cb()
2012-08-17 20:33 [PATCH] caif: Do not dereference NULL in chnl_recv_cb() Jesper Juhl
@ 2012-08-20 6:33 ` Sjur BRENDELAND
2012-08-20 9:48 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: Sjur BRENDELAND @ 2012-08-20 6:33 UTC (permalink / raw)
To: Jesper Juhl, linux-kernel@vger.kernel.org
Cc: netdev@vger.kernel.org, David S. Miller, Daniel MARTENSSON
> In net/caif/chnl_net.c::chnl_recv_cb() we call skb_header_pointer()
> which may return NULL, but we do not check for a NULL pointer before
> dereferencing it.
> This patch adds such a NULL check and properly free's allocated memory
> and return an error (-EINVAL) on failure - much better than crashing..
>
> Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Thank you for fixing this, the patch looks good to me.
Acked-by: Sjur Brændeland <sjur.brandeland@stericsson.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] caif: Do not dereference NULL in chnl_recv_cb()
2012-08-20 6:33 ` Sjur BRENDELAND
@ 2012-08-20 9:48 ` David Miller
0 siblings, 0 replies; 3+ messages in thread
From: David Miller @ 2012-08-20 9:48 UTC (permalink / raw)
To: sjur.brandeland; +Cc: jj, linux-kernel, netdev, daniel.martensson
From: Sjur BRENDELAND <sjur.brandeland@stericsson.com>
Date: Mon, 20 Aug 2012 08:33:35 +0200
>> In net/caif/chnl_net.c::chnl_recv_cb() we call skb_header_pointer()
>> which may return NULL, but we do not check for a NULL pointer before
>> dereferencing it.
>> This patch adds such a NULL check and properly free's allocated memory
>> and return an error (-EINVAL) on failure - much better than crashing..
>>
>> Signed-off-by: Jesper Juhl <jj@chaosbits.net>
>
> Thank you for fixing this, the patch looks good to me.
> Acked-by: Sjur Brændeland <sjur.brandeland@stericsson.com>
Applied, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2012-08-20 9:48 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-08-17 20:33 [PATCH] caif: Do not dereference NULL in chnl_recv_cb() Jesper Juhl
2012-08-20 6:33 ` Sjur BRENDELAND
2012-08-20 9:48 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).