* [Patch net] kcm: fix a null pointer dereference in kcm_sendmsg()
@ 2017-02-13 19:13 Cong Wang
2017-02-13 19:18 ` Tom Herbert
2017-02-14 18:07 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Cong Wang @ 2017-02-13 19:13 UTC (permalink / raw)
To: netdev; +Cc: dvyukov, Cong Wang, Tom Herbert
In commit 98e3862ca2b1 ("kcm: fix 0-length case for kcm_sendmsg()")
I tried to avoid skb allocation for 0-length case, but missed
a check for NULL pointer in the non EOR case.
Fixes: 98e3862ca2b1 ("kcm: fix 0-length case for kcm_sendmsg()")
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Tom Herbert <tom@herbertland.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
net/kcm/kcmsock.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index 64f0e85..a646f34 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1044,8 +1044,10 @@ static int kcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
} else {
/* Message not complete, save state */
partial_message:
- kcm->seq_skb = head;
- kcm_tx_msg(head)->last_skb = skb;
+ if (head) {
+ kcm->seq_skb = head;
+ kcm_tx_msg(head)->last_skb = skb;
+ }
}
KCM_STATS_ADD(kcm->stats.tx_bytes, copied);
--
2.5.5
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [Patch net] kcm: fix a null pointer dereference in kcm_sendmsg()
2017-02-13 19:13 [Patch net] kcm: fix a null pointer dereference in kcm_sendmsg() Cong Wang
@ 2017-02-13 19:18 ` Tom Herbert
2017-02-14 18:07 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Tom Herbert @ 2017-02-13 19:18 UTC (permalink / raw)
To: Cong Wang; +Cc: Linux Kernel Network Developers, dvyukov
On Mon, Feb 13, 2017 at 11:13 AM, Cong Wang <xiyou.wangcong@gmail.com> wrote:
> In commit 98e3862ca2b1 ("kcm: fix 0-length case for kcm_sendmsg()")
> I tried to avoid skb allocation for 0-length case, but missed
> a check for NULL pointer in the non EOR case.
>
> Fixes: 98e3862ca2b1 ("kcm: fix 0-length case for kcm_sendmsg()")
> Reported-by: Dmitry Vyukov <dvyukov@google.com>
> Cc: Tom Herbert <tom@herbertland.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Tom Herbert <tom@herbertland.com>
> ---
> net/kcm/kcmsock.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
> index 64f0e85..a646f34 100644
> --- a/net/kcm/kcmsock.c
> +++ b/net/kcm/kcmsock.c
> @@ -1044,8 +1044,10 @@ static int kcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
> } else {
> /* Message not complete, save state */
> partial_message:
> - kcm->seq_skb = head;
> - kcm_tx_msg(head)->last_skb = skb;
> + if (head) {
> + kcm->seq_skb = head;
> + kcm_tx_msg(head)->last_skb = skb;
> + }
> }
>
> KCM_STATS_ADD(kcm->stats.tx_bytes, copied);
> --
> 2.5.5
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [Patch net] kcm: fix a null pointer dereference in kcm_sendmsg()
2017-02-13 19:13 [Patch net] kcm: fix a null pointer dereference in kcm_sendmsg() Cong Wang
2017-02-13 19:18 ` Tom Herbert
@ 2017-02-14 18:07 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2017-02-14 18:07 UTC (permalink / raw)
To: xiyou.wangcong; +Cc: netdev, dvyukov, tom
From: Cong Wang <xiyou.wangcong@gmail.com>
Date: Mon, 13 Feb 2017 11:13:16 -0800
> In commit 98e3862ca2b1 ("kcm: fix 0-length case for kcm_sendmsg()")
> I tried to avoid skb allocation for 0-length case, but missed
> a check for NULL pointer in the non EOR case.
>
> Fixes: 98e3862ca2b1 ("kcm: fix 0-length case for kcm_sendmsg()")
> Reported-by: Dmitry Vyukov <dvyukov@google.com>
> Cc: Tom Herbert <tom@herbertland.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Applied, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-02-14 18:07 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-02-13 19:13 [Patch net] kcm: fix a null pointer dereference in kcm_sendmsg() Cong Wang
2017-02-13 19:18 ` Tom Herbert
2017-02-14 18:07 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).