| Message ID | 1481791661-21670-1-git-send-email-shakya.das@samsung.com |
|---|---|
| State | Rejected, archived |
| Delegated to: | David Miller |
| Headers | show |
On 2016-12-15 at 09:47:41 +0100, shakya.das@samsung.com <shakya.das@samsung.com> wrote: > From: Shakya Sundar Das <shakya.das@samsung.com> > > This patch will check segs for being NULL in tcp_gso_segment() > before calling skb_shinfo(segs) from skb_is_gso(segs), otherwise > kernel can run into a NULL-pointer dereference. How can segs ever be NULL here? skb_segment() will always either return an skb or an ERR_PTR(err).
On Thu, 2016-12-15 at 14:17 +0530, shakya.das@samsung.com wrote: > From: Shakya Sundar Das <shakya.das@samsung.com> > > This patch will check segs for being NULL in tcp_gso_segment() > before calling skb_shinfo(segs) from skb_is_gso(segs), otherwise > kernel can run into a NULL-pointer dereference. > > Signed-off-by: Shakya Sundar Das <shakya.das@samsung.com> > --- > net/ipv4/tcp_offload.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c > index bc68da3..93feefd 100644 > --- a/net/ipv4/tcp_offload.c > +++ b/net/ipv4/tcp_offload.c > @@ -96,7 +96,7 @@ struct sk_buff *tcp_gso_segment(struct sk_buff *skb, > skb->ooo_okay = 0; > > segs = skb_segment(skb, features); > - if (IS_ERR(segs)) > + if (IS_ERR_OR_NULL(segs)) > goto out; > > /* Only first segment might have ooo_okay set */ I do not see how this can ever happen. How did you come up with this patch exactly ???
diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c index bc68da3..93feefd 100644 --- a/net/ipv4/tcp_offload.c +++ b/net/ipv4/tcp_offload.c @@ -96,7 +96,7 @@ struct sk_buff *tcp_gso_segment(struct sk_buff *skb, skb->ooo_okay = 0; segs = skb_segment(skb, features); - if (IS_ERR(segs)) + if (IS_ERR_OR_NULL(segs)) goto out; /* Only first segment might have ooo_okay set */