Commit 3db0a197 authored Nov 13, 2013 by Erik Hugne Committed by David S. Miller Nov 15, 2013

tipc: fix dereference before check warning



This fixes the following Smatch warning:
net/tipc/link.c:2364 tipc_link_recv_fragment()
    warn: variable dereferenced before check '*head' (see line 2361)

A null pointer might be passed to skb_try_coalesce if
a malicious sender injects orphan fragments on a link.

Signed-off-by: Erik Hugne <erik.hugne@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent c9e90429

net/tipc/link.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -2358,7 +2358,8 @@ int tipc_link_recv_fragment(struct sk_buff head, struct sk_buff tail,
		*head = frag;
		skb_frag_list_init(*head);
		return 0;
		} else if (skb_try_coalesce(*head, frag, &headstolen, &delta)) {
		} else if (*head &&
		skb_try_coalesce(*head, frag, &headstolen, &delta)) {
		kfree_skb_partial(frag, headstolen);
		} else {
		if (!*head)

Admin message