OSDN Git Service

bpf: skmsg, fix potential psock NULL pointer dereference
authorJohn Fastabend <john.fastabend@gmail.com>
Thu, 21 Nov 2019 16:25:09 +0000 (08:25 -0800)
committerDavid S. Miller <davem@davemloft.net>
Thu, 21 Nov 2019 21:43:45 +0000 (13:43 -0800)
commit8163999db445021f2651a8a47b5632483e8722ea
tree044f73c60b4d6d2becf9a03c5c78170d7dbe1e98
parent7599a896f2e46e9c072e02a8299a67d4d2f96675
bpf: skmsg, fix potential psock NULL pointer dereference

Report from Dan Carpenter,

 net/core/skmsg.c:792 sk_psock_write_space()
 error: we previously assumed 'psock' could be null (see line 790)

 net/core/skmsg.c
   789 psock = sk_psock(sk);
   790 if (likely(psock && sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)))
 Check for NULL
   791 schedule_work(&psock->work);
   792 write_space = psock->saved_write_space;
                     ^^^^^^^^^^^^^^^^^^^^^^^^
   793          rcu_read_unlock();
   794          write_space(sk);

Ensure psock dereference on line 792 only occurs if psock is not null.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/core/skmsg.c