Messages in this thread | | | From | Rainer Weikusat <> | Subject | Re: [PATCH] net: Fix potential NULL pointer dereference in __skb_try_recv_datagram | Date | Tue, 29 Dec 2015 19:42:36 +0000 |
| |
Jacob Siverskog <jacob@teenage.engineering> writes: > This should fix a NULL pointer dereference I encountered (dump > below). Since __skb_unlink is called while walking, > skb_queue_walk_safe should be used.
The code in question is:
skb_queue_walk(queue, skb) { *last = skb; *peeked = skb->peeked; if (flags & MSG_PEEK) { if (_off >= skb->len && (skb->len || _off || skb->peeked)) { _off -= skb->len; continue; }
skb = skb_set_peeked(skb); error = PTR_ERR(skb); if (IS_ERR(skb)) { spin_unlock_irqrestore(&queue->lock, cpu_flags); goto no_packet; } atomic_inc(&skb->users); } else __skb_unlink(skb, queue);
spin_unlock_irqrestore(&queue->lock, cpu_flags); *off = _off; return skb; }
__skb_unlink is only called prior to returning from the function. Consequently, it won't affect the skb_queue_walk code.
| |