[PATCH net-next] tipc: Fix NULL pointer dereference in __tipc_sendstream()

* [PATCH net-next] tipc: Fix NULL pointer dereference in __tipc_sendstream()
@ 2020-05-28 14:34 YueHaibing
  2020-06-01 18:34 ` David Miller
  2020-06-01 22:35 ` David Miller
  0 siblings, 2 replies; 3+ messages in thread
From: YueHaibing @ 2020-05-28 14:34 UTC (permalink / raw)
  To: jmaloy, ying.xue, davem, kuba, tuong.t.lien
  Cc: netdev, tipc-discussion, linux-kernel, YueHaibing

tipc_sendstream() may send zero length packet, then tipc_msg_append()
do not alloc skb, skb_peek_tail() will get NULL, msg_set_ack_required
will trigger NULL pointer dereference.

Reported-by: syzbot+8eac6d030e7807c21d32@syzkaller.appspotmail.com
Fixes: 0a3e060f340d ("tipc: add test for Nagle algorithm effectiveness")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
---
 net/tipc/socket.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index d6b67d07d22e..2943561399f1 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1588,8 +1588,12 @@ static int __tipc_sendstream(struct socket *sock, struct msghdr *m, size_t dlen)
 				tsk->pkt_cnt += skb_queue_len(txq);
 			} else {
 				skb = skb_peek_tail(txq);
-				msg_set_ack_required(buf_msg(skb));
-				tsk->expect_ack = true;
+				if (skb) {
+					msg_set_ack_required(buf_msg(skb));
+					tsk->expect_ack = true;
+				} else {
+					tsk->expect_ack = false;
+				}
 				tsk->msg_acc = 0;
 				tsk->pkt_cnt = 0;
 			}
-- 
2.17.1



^ permalink raw reply related	[flat|nested] 3+ messages in thread