]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commitdiff
tipc: fix dereference before check warning
authorErik Hugne <erik.hugne@ericsson.com>
Wed, 13 Nov 2013 08:35:11 +0000 (09:35 +0100)
committerDavid S. Miller <davem@davemloft.net>
Fri, 15 Nov 2013 08:11:06 +0000 (03:11 -0500)
This fixes the following Smatch warning:
net/tipc/link.c:2364 tipc_link_recv_fragment()
    warn: variable dereferenced before check '*head' (see line 2361)

A null pointer might be passed to skb_try_coalesce if
a malicious sender injects orphan fragments on a link.

Signed-off-by: Erik Hugne <erik.hugne@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/tipc/link.c

index cf465d66ccdec9506bab01cb7390fcd169b50dfc..69cd9bf3f561d64d377ddb65091b98e1017e15cf 100644 (file)
@@ -2358,7 +2358,8 @@ int tipc_link_recv_fragment(struct sk_buff **head, struct sk_buff **tail,
                *head = frag;
                skb_frag_list_init(*head);
                return 0;
-       } else if (skb_try_coalesce(*head, frag, &headstolen, &delta)) {
+       } else if (*head &&
+                  skb_try_coalesce(*head, frag, &headstolen, &delta)) {
                kfree_skb_partial(frag, headstolen);
        } else {
                if (!*head)