Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1591561 > unrolled thread

[PATCH net] rxrpc: Fix potential NULL-pointer exception

Back to article view | Back to linux.kernel

Contents

  [PATCH net] rxrpc: Fix potential NULL-pointer exception David Howells <dhowells@redhat.com> - 2017-03-03 01:00 +0100
    Re: [PATCH net] rxrpc: Fix potential NULL-pointer exception David Howells <dhowells@redhat.com> - 2017-03-03 04:50 +0100
    Re: [PATCH net] rxrpc: Fix potential NULL-pointer exception David Miller <davem@davemloft.net> - 2017-03-03 19:20 +0100

#1591561 — [PATCH net] rxrpc: Fix potential NULL-pointer exception

Fix a potential NULL-pointer exception in rxrpc_do_sendmsg().  The call
state check that I added should have gone into the else-body of the
if-statement where we actually have a call to check.

Found by CoverityScan CID#1414316 ("Dereference after null check").

Fixes: 540b1c48c37a ("rxrpc: Fix deadlock between call creation and sendmsg/recvmsg")
Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: David Howells <dhowells@redhat.com>
---

 net/rxrpc/sendmsg.c |   15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index 75c5179227f2..344c2a60627b 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -518,6 +518,13 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
 		ret = -EBADSLT;
 		if (cmd != RXRPC_CMD_SEND_DATA)
 			goto error_release_sock;
+		call = rxrpc_new_client_call_for_sendmsg(rx, msg, user_call_ID,
+							 exclusive);
+		/* The socket is now unlocked... */
+		if (IS_ERR(call))
+			return PTR_ERR(call);
+		/* ... and we have the call lock. */
+	} else {
 		switch (READ_ONCE(call->state)) {
 		case RXRPC_CALL_UNINITIALISED:
 		case RXRPC_CALL_CLIENT_AWAIT_CONN:
@@ -529,13 +536,7 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
 		default:
 			break;
 		}
-		call = rxrpc_new_client_call_for_sendmsg(rx, msg, user_call_ID,
-							 exclusive);
-		/* The socket is now unlocked... */
-		if (IS_ERR(call))
-			return PTR_ERR(call);
-		/* ... and we have the call lock. */
-	} else {
+
 		ret = mutex_lock_interruptible(&call->user_mutex);
 		release_sock(&rx->sk);
 		if (ret < 0) {

[toc] | [next] | [standalone]

#1591661

David Howells <dhowells@redhat.com> wrote:

> Fix a potential NULL-pointer exception in rxrpc_do_sendmsg().  The call
> state check that I added should have gone into the else-body of the
> if-statement where we actually have a call to check.
> 
> Found by CoverityScan CID#1414316 ("Dereference after null check").
> 
> Fixes: 540b1c48c37a ("rxrpc: Fix deadlock between call creation and sendmsg/recvmsg")
> Reported-by: Colin Ian King <colin.king@canonical.com>
> Signed-off-by: David Howells <dhowells@redhat.com>

Please ignore this - there's another patch interposed that I haven't sent
upstream yet.  Will rebase on net/master.

David

[toc] | [prev] | [next] | [standalone]

#1592185

From: David Howells <dhowells@redhat.com>
Date: Thu, 02 Mar 2017 23:26:13 +0000

> Fix a potential NULL-pointer exception in rxrpc_do_sendmsg().  The call
> state check that I added should have gone into the else-body of the
> if-statement where we actually have a call to check.
> 
> Found by CoverityScan CID#1414316 ("Dereference after null check").
> 
> Fixes: 540b1c48c37a ("rxrpc: Fix deadlock between call creation and sendmsg/recvmsg")
> Reported-by: Colin Ian King <colin.king@canonical.com>
> Signed-off-by: David Howells <dhowells@redhat.com>

Applied.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web