All of lore.kernel.org
 help / color / mirror / Atom feed
From: Marc Kleine-Budde <mkl@pengutronix.de>
To: netdev@vger.kernel.org
Cc: davem@davemloft.net, linux-can@vger.kernel.org,
	kernel@pengutronix.de, Colin Ian King <colin.king@canonical.com>,
	Marc Kleine-Budde <mkl@pengutronix.de>
Subject: [PATCH 07/11] can: bcm: check for null sk before deferencing it via the call to sock_net
Date: Thu, 19 Oct 2017 13:19:41 +0200	[thread overview]
Message-ID: <20171019111945.13580-8-mkl@pengutronix.de> (raw)
In-Reply-To: <20171019111945.13580-1-mkl@pengutronix.de>

From: Colin Ian King <colin.king@canonical.com>

The assignment of net via call sock_net will dereference sk. This
is performed before a sanity null check on sk, so there could be
a potential null dereference on the sock_net call if sk is null.
Fix this by assigning net after the sk null check. Also replace
the sk == NULL with the more usual !sk idiom.

Detected by CoverityScan CID#1431862 ("Dereference before null check")

Fixes: 384317ef4187 ("can: network namespace support for CAN_BCM protocol")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
 net/can/bcm.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/can/bcm.c b/net/can/bcm.c
index 47a8748d953a..13690334efa3 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1493,13 +1493,14 @@ static int bcm_init(struct sock *sk)
 static int bcm_release(struct socket *sock)
 {
 	struct sock *sk = sock->sk;
-	struct net *net = sock_net(sk);
+	struct net *net;
 	struct bcm_sock *bo;
 	struct bcm_op *op, *next;
 
-	if (sk == NULL)
+	if (!sk)
 		return 0;
 
+	net = sock_net(sk);
 	bo = bcm_sk(sk);
 
 	/* remove bcm_ops, timer, rx_unregister(), etc. */
-- 
2.14.2

  parent reply	other threads:[~2017-10-19 11:19 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-10-19 11:19 pull-request: can 2017-10-19 Marc Kleine-Budde
2017-10-19 11:19 ` [PATCH 01/11] can: flexcan: fix state transition regression Marc Kleine-Budde
2017-10-19 11:19 ` [PATCH 02/11] can: flexcan: rename legacy error state quirk Marc Kleine-Budde
2017-10-19 11:19 ` [PATCH 03/11] can: flexcan: implement error passive " Marc Kleine-Budde
2017-10-19 11:19 ` [PATCH 04/11] can: flexcan: fix i.MX6 state transition issue Marc Kleine-Budde
2017-10-19 11:19 ` [PATCH 05/11] can: flexcan: fix i.MX28 " Marc Kleine-Budde
2017-10-19 11:19 ` [PATCH 06/11] can: flexcan: fix p1010 " Marc Kleine-Budde
2017-10-19 11:19 ` Marc Kleine-Budde [this message]
2017-10-19 11:19 ` [PATCH 08/11] can: af_can: do not access proto_tab directly use rcu_access_pointer instead Marc Kleine-Budde
2017-10-19 11:19 ` [PATCH 09/11] can: af_can: can_pernet_init(): add missing error handling for kzalloc returning NULL Marc Kleine-Budde
2017-10-19 11:19 ` [PATCH 10/11] can: esd_usb2: Fix can_dlc value for received RTR, frames Marc Kleine-Budde
2017-10-19 11:19 ` [PATCH 11/11] can: gs_usb: fix busy loop if no more TX context is available Marc Kleine-Budde
2017-10-21  1:30 ` pull-request: can 2017-10-19 David Miller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20171019111945.13580-8-mkl@pengutronix.de \
    --to=mkl@pengutronix.de \
    --cc=colin.king@canonical.com \
    --cc=davem@davemloft.net \
    --cc=kernel@pengutronix.de \
    --cc=linux-can@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.