releases/4.9.13/kcm-fix-a-null-pointer-dereference-in-kcm_sendmsg.patch

   1 From foo@baz Thu Feb 23 21:13:05 CET 2017
   2 From: WANG Cong <xiyou.wangcong@gmail.com>
   3 Date: Mon, 13 Feb 2017 11:13:16 -0800
   4 Subject: kcm: fix a null pointer dereference in kcm_sendmsg()
   5
   6 From: WANG Cong <xiyou.wangcong@gmail.com>
   7
   8
   9 [ Upstream commit cd27b96bc13841ee7af25837a6ae86fee87273d6 ]
  10
  11 In commit 98e3862ca2b1 ("kcm: fix 0-length case for kcm_sendmsg()")
  12 I tried to avoid skb allocation for 0-length case, but missed
  13 a check for NULL pointer in the non EOR case.
  14
  15 Fixes: 98e3862ca2b1 ("kcm: fix 0-length case for kcm_sendmsg()")
  16 Reported-by: Dmitry Vyukov <dvyukov@google.com>
  17 Cc: Tom Herbert <tom@herbertland.com>
  18 Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
  19 Acked-by: Tom Herbert <tom@herbertland.com>
  20 Signed-off-by: David S. Miller <davem@davemloft.net>
  21 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  22 ---
  23  net/kcm/kcmsock.c |    6 ++++--
  24  1 file changed, 4 insertions(+), 2 deletions(-)
  25
  26 --- a/net/kcm/kcmsock.c
  27 +++ b/net/kcm/kcmsock.c
  28 @@ -1044,8 +1044,10 @@ wait_for_memory:
  29         } else {
  30                 /* Message not complete, save state */
  31  partial_message:
  32 -               kcm->seq_skb = head;
  33 -               kcm_tx_msg(head)->last_skb = skb;
  34 +               if (head) {
  35 +                       kcm->seq_skb = head;
  36 +                       kcm_tx_msg(head)->last_skb = skb;
  37 +               }
  38         }
  39
  40         KCM_STATS_ADD(kcm->stats.tx_bytes, copied);