BackPup/Linux
1
0 Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-07 22:37:45 -04:00
Code Issues Packages Projects Releases Wiki Activity

tipc: Fix NULL pointer dereference in __tipc_sendstream()

Browse Source 
tipc_sendstream() may send zero length packet, then tipc_msg_append()
do not alloc skb, skb_peek_tail() will get NULL, msg_set_ack_required
will trigger NULL pointer dereference.

Reported-by: [email protected]
Fixes: 0a3e060f34 ("tipc: add test for Nagle algorithm effectiveness")
Signed-off-by: YueHaibing <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
This commit is contained in:
YueHaibing authored and David S. Miller committed 2020-06-01 15:33:24 -07:00
1 parent eae9d3c016
commit 4c21daae3d
1 file changed
+6 -2
Download Patch File Download Diff File Expand all files Collapse all files
net/tipc/socket.c
+6 -2
View File
@@ -1588,8 +1588,12 @@ static int __tipc_sendstream(struct socket *sock, struct msghdr *m, size_t dlen)
tsk->pkt_cnt += skb_queue_len(txq);
} else {
skb = skb_peek_tail(txq);
msg_set_ack_required(buf_msg(skb));
tsk->expect_ack = true;
if (skb) {
msg_set_ack_required(buf_msg(skb));
tsk->expect_ack = true;
} else {
tsk->expect_ack = false;
}
tsk->msg_acc = 0;
tsk->pkt_cnt = 0;
}