On Mon, Feb 13, 2017 at 11:13 AM, Cong Wang <xiyou.wangc...@gmail.com> wrote:
> In commit 98e3862ca2b1 ("kcm: fix 0-length case for kcm_sendmsg()")
> I tried to avoid skb allocation for 0-length case, but missed
> a check for NULL pointer in the non EOR case.
>
> Fixes: 98e3862ca2b1 ("kcm: fix 0-length case for kcm_sendmsg()")
> Reported-by: Dmitry Vyukov <dvyu...@google.com>
> Cc: Tom Herbert <t...@herbertland.com>
> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com>
Acked-by: Tom Herbert <t...@herbertland.com>
> ---
> net/kcm/kcmsock.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
> index 64f0e85..a646f34 100644
> --- a/net/kcm/kcmsock.c
> +++ b/net/kcm/kcmsock.c
> @@ -1044,8 +1044,10 @@ static int kcm_sendmsg(struct socket *sock, struct
> msghdr *msg, size_t len)
> } else {
> /* Message not complete, save state */
> partial_message:
> - kcm->seq_skb = head;
> - kcm_tx_msg(head)->last_skb = skb;
> + if (head) {
> + kcm->seq_skb = head;
> + kcm_tx_msg(head)->last_skb = skb;
> + }
> }
>
> KCM_STATS_ADD(kcm->stats.tx_bytes, copied);
> --
> 2.5.5
>
