Commit 4c21daae authored by YueHaibing's avatar YueHaibing Committed by David S. Miller

tipc: Fix NULL pointer dereference in __tipc_sendstream()

tipc_sendstream() may send zero length packet, then tipc_msg_append()
do not alloc skb, skb_peek_tail() will get NULL, msg_set_ack_required
will trigger NULL pointer dereference.

Reported-by: syzbot+8eac6d030e7807c21d32@syzkaller.appspotmail.com
Fixes: 0a3e060f ("tipc: add test for Nagle algorithm effectiveness")
Signed-off-by: default avatarYueHaibing <yuehaibing@huawei.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent eae9d3c0
...@@ -1588,8 +1588,12 @@ static int __tipc_sendstream(struct socket *sock, struct msghdr *m, size_t dlen) ...@@ -1588,8 +1588,12 @@ static int __tipc_sendstream(struct socket *sock, struct msghdr *m, size_t dlen)
tsk->pkt_cnt += skb_queue_len(txq); tsk->pkt_cnt += skb_queue_len(txq);
} else { } else {
skb = skb_peek_tail(txq); skb = skb_peek_tail(txq);
if (skb) {
msg_set_ack_required(buf_msg(skb)); msg_set_ack_required(buf_msg(skb));
tsk->expect_ack = true; tsk->expect_ack = true;
} else {
tsk->expect_ack = false;
}
tsk->msg_acc = 0; tsk->msg_acc = 0;
tsk->pkt_cnt = 0; tsk->pkt_cnt = 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment