Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1587419

[PATCH 4.9 02/32] kcm: fix a null pointer dereference in kcm_sendmsg()

Show all headers | View raw

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: WANG Cong <xiyou.wangcong@gmail.com>


[ Upstream commit cd27b96bc13841ee7af25837a6ae86fee87273d6 ]

In commit 98e3862ca2b1 ("kcm: fix 0-length case for kcm_sendmsg()")
I tried to avoid skb allocation for 0-length case, but missed
a check for NULL pointer in the non EOR case.

Fixes: 98e3862ca2b1 ("kcm: fix 0-length case for kcm_sendmsg()")
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Tom Herbert <tom@herbertland.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Tom Herbert <tom@herbertland.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/kcm/kcmsock.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1044,8 +1044,10 @@ wait_for_memory:
 	} else {
 		/* Message not complete, save state */
 partial_message:
-		kcm->seq_skb = head;
-		kcm_tx_msg(head)->last_skb = skb;
+		if (head) {
+			kcm->seq_skb = head;
+			kcm_tx_msg(head)->last_skb = skb;
+		}
 	}
 
 	KCM_STATS_ADD(kcm->stats.tx_bytes, copied);

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.9 00/32] 4.9.13-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:40 +0100
  [PATCH 4.9 27/32] goldfish: Sanitize the broken interrupt handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 23/32] USB: serial: opticon: fix CTS retrieval at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 30/32] block: fix double-free in the failure path of cgwb_bdi_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 13/32] ip: fix IP_CHECKSUM handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 28/32] netfilter: nf_ct_helper: warn when not applying default helper assignment Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 31/32] rtlwifi: rtl_usb: Fix for URB leaking when doing ifconfig up/down Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 17/32] USB: serial: cp210x: add new IDs for GE Bx50v3 boards Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 16/32] USB: serial: mos7840: fix another NULL-deref at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 25/32] USB: serial: console: fix uninitialised spinlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 11/32] irda: Fix lockdep annotations in hashbin_delete(). Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 24/32] USB: serial: ark3116: fix register-accessor error handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 15/32] tty: serial: msm: Fix module autoload Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 29/32] ACPICA: Linuxize: Restore and fix Intel compiler build Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 32/32] xfs: clear delalloc and cache on buffered write failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 22/32] USB: serial: spcp8x5: fix modem-status handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 08/32] net: neigh: Fix netevent NETEVENT_DELAY_PROBE_TIME_UPDATE notification Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 26/32] x86/platform/goldfish: Prevent unconditional loading Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 12/32] ptr_ring: fix race conditions when resizing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100
  [PATCH 4.9 02/32] kcm: fix a null pointer dereference in kcm_sendmsg() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100
  [PATCH 4.9 07/32] packet: Do not call fanout_release from atomic contexts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100
  [PATCH 4.9 04/32] net/llc: avoid BUG_ON() in skb_orphan() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100
  [PATCH 4.9 14/32] net: socket: fix recvmmsg not returning error from sock_error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100
  [PATCH 4.9 10/32] vxlan: fix oops in dev_fill_metadata_dst Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100
  [PATCH 4.9 03/32] net/mlx5e: Disable preemption when doing TC statistics upcall Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100
  [PATCH 4.9 19/32] USB: serial: ftdi_sio: fix extreme low-latency setting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100
  Re: [PATCH 4.9 00/32] 4.9.13-stable review Guenter Roeck <linux@roeck-us.net> - 2017-02-24 18:30 +0100
  Re: [PATCH 4.9 00/32] 4.9.13-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-02-24 19:20 +0100
  Re: [PATCH 4.9 00/32] 4.9.13-stable review Alexandre Belloni <alexandre.belloni@free-electrons.com> - 2017-02-27 00:00 +0100

csiph-web