Message ID | 1486501187-12869-1-git-send-email-xiyou.wangcong@gmail.com |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
From: Cong Wang <xiyou.wangcong@gmail.com> Date: Tue, 7 Feb 2017 12:59:46 -0800 > Andrey reported a kernel crash: ... > This is because we miss a check for NULL pointer for skb_peek() when > the queue is empty. Other places already have the same check. > > Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind") > Reported-by: Andrey Konovalov <andreyknvl@google.com> > Tested-by: Andrey Konovalov <andreyknvl@google.com> > Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Applied and queued up for -stable, thanks Cong.
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c index 86cca61..68d77b1 100644 --- a/net/ipv4/ping.c +++ b/net/ipv4/ping.c @@ -642,6 +642,8 @@ static int ping_v4_push_pending_frames(struct sock *sk, struct pingfakehdr *pfh, { struct sk_buff *skb = skb_peek(&sk->sk_write_queue); + if (!skb) + return 0; pfh->wcheck = csum_partial((char *)&pfh->icmph, sizeof(struct icmphdr), pfh->wcheck); pfh->icmph.checksum = csum_fold(pfh->wcheck);