summaryrefslogtreecommitdiff
path: root/net/tipc/socket.c
diff options
context:
space:
mode:
authorYueHaibing <yuehaibing@huawei.com>2020-05-28 22:34:07 +0800
committerDavid S. Miller <davem@davemloft.net>2020-06-01 15:33:24 -0700
commit4c21daae3dbc9f8536cc18e6e53627821fa2c90c (patch)
tree6fe27ee7cb67f7f769a420f7aa329bd1dd24d004 /net/tipc/socket.c
parenteae9d3c0167df840e821317040efcf0ca6789cb9 (diff)
tipc: Fix NULL pointer dereference in __tipc_sendstream()
tipc_sendstream() may send zero length packet, then tipc_msg_append() do not alloc skb, skb_peek_tail() will get NULL, msg_set_ack_required will trigger NULL pointer dereference. Reported-by: syzbot+8eac6d030e7807c21d32@syzkaller.appspotmail.com Fixes: 0a3e060f340d ("tipc: add test for Nagle algorithm effectiveness") Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/tipc/socket.c')
-rw-r--r--net/tipc/socket.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 3734cdbedc9c..26123f4177fd 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1588,8 +1588,12 @@ static int __tipc_sendstream(struct socket *sock, struct msghdr *m, size_t dlen)
tsk->pkt_cnt += skb_queue_len(txq);
} else {
skb = skb_peek_tail(txq);
- msg_set_ack_required(buf_msg(skb));
- tsk->expect_ack = true;
+ if (skb) {
+ msg_set_ack_required(buf_msg(skb));
+ tsk->expect_ack = true;
+ } else {
+ tsk->expect_ack = false;
+ }
tsk->msg_acc = 0;
tsk->pkt_cnt = 0;
}