mirror of
https://abf.rosa.ru/djam/kernel-5.13.git
synced 2025-02-25 16:12:50 +00:00
40 lines
1.2 KiB
Diff
40 lines
1.2 KiB
Diff
From foo@baz Thu Feb 23 21:13:05 CET 2017
|
|
From: WANG Cong <xiyou.wangcong@gmail.com>
|
|
Date: Mon, 13 Feb 2017 11:13:16 -0800
|
|
Subject: kcm: fix a null pointer dereference in kcm_sendmsg()
|
|
|
|
From: WANG Cong <xiyou.wangcong@gmail.com>
|
|
|
|
|
|
[ Upstream commit cd27b96bc13841ee7af25837a6ae86fee87273d6 ]
|
|
|
|
In commit 98e3862ca2b1 ("kcm: fix 0-length case for kcm_sendmsg()")
|
|
I tried to avoid skb allocation for 0-length case, but missed
|
|
a check for NULL pointer in the non EOR case.
|
|
|
|
Fixes: 98e3862ca2b1 ("kcm: fix 0-length case for kcm_sendmsg()")
|
|
Reported-by: Dmitry Vyukov <dvyukov@google.com>
|
|
Cc: Tom Herbert <tom@herbertland.com>
|
|
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
|
|
Acked-by: Tom Herbert <tom@herbertland.com>
|
|
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
---
|
|
net/kcm/kcmsock.c | 6 ++++--
|
|
1 file changed, 4 insertions(+), 2 deletions(-)
|
|
|
|
--- a/net/kcm/kcmsock.c
|
|
+++ b/net/kcm/kcmsock.c
|
|
@@ -1044,8 +1044,10 @@ wait_for_memory:
|
|
} else {
|
|
/* Message not complete, save state */
|
|
partial_message:
|
|
- kcm->seq_skb = head;
|
|
- kcm_tx_msg(head)->last_skb = skb;
|
|
+ if (head) {
|
|
+ kcm->seq_skb = head;
|
|
+ kcm_tx_msg(head)->last_skb = skb;
|
|
+ }
|
|
}
|
|
|
|
KCM_STATS_ADD(kcm->stats.tx_bytes, copied);
|