Messages in this thread Patch in this message | | | From | Thomas Dreibholz <> | Subject | [PATCH] net: SCTP NULL-pointer dereference problem description and fix | Date | Tue, 14 Sep 2010 19:01:09 +0200 |
| |
sctp_assoc_update_retran_path() in net/sctp/associola.c may dereference a NULL-pointer when compiled with SCTP_DEBUG option: t will be NULL if there is no usable path for retransmission. SCTP_DEBUG_PRINTK_IPADDR() makes an access to t->ipaddr.v4.sin_port, without checking t before. t==NULL => oops.
The patch below against 2.6.36-rc4 (git repository) simply ensures that t is checked for not being set to NULL before calling SCTP_DEBUG_PRINTK_IPADDR().
Signed-off-by: Thomas Dreibholz <dreibh@iem.uni-due.de> --- diff --git a/net/sctp/associola.c b/net/sctp/associola.c index e41feff..b2688a4 100644 --- a/net/sctp/associola.c +++ b/net/sctp/associola.c @@ -1321,15 +1321,15 @@ void sctp_assoc_update_retran_path(struct sctp_association *asoc) } }
- if (t) + if (t) { asoc->peer.retran_path = t; - - SCTP_DEBUG_PRINTK_IPADDR("sctp_assoc_update_retran_path:association" - " %p addr: ", - " port: %d\n", - asoc, - (&t->ipaddr), - ntohs(t->ipaddr.v4.sin_port)); + SCTP_DEBUG_PRINTK_IPADDR("sctp_assoc_update_retran_path:association" + " %p addr: ", + " port: %d\n", + asoc, + (&t->ipaddr), + ntohs(t->ipaddr.v4.sin_port)); + } }
/* Choose the transport for sending retransmit packet. */
| |