Commit 4c21daae authored May 28, 2020 by YueHaibing Committed by David S. Miller Jun 01, 2020

tipc: Fix NULL pointer dereference in __tipc_sendstream()



tipc_sendstream() may send zero length packet, then tipc_msg_append()
do not alloc skb, skb_peek_tail() will get NULL, msg_set_ack_required
will trigger NULL pointer dereference.

Reported-by:  <syzbot+8eac6d030e7807c21d32@syzkaller.appspotmail.com>
Fixes: 0a3e060f ("tipc: add test for Nagle algorithm effectiveness")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent eae9d3c0

net/tipc/socket.c

+6 −2

Original line number	Diff line number	Diff line
		@@ -1588,8 +1588,12 @@ static int __tipc_sendstream(struct socket sock, struct msghdr m, size_t dlen)
		tsk->pkt_cnt += skb_queue_len(txq);
		} else {
		skb = skb_peek_tail(txq);
		if (skb) {
		msg_set_ack_required(buf_msg(skb));
		tsk->expect_ack = true;
		} else {
		tsk->expect_ack = false;
		}
		tsk->msg_acc = 0;
		tsk->pkt_cnt = 0;
		}

Admin message