diff options
| author | Mathias Krause <minipli@googlemail.com> | 2012-08-15 11:31:54 +0000 |
|---|---|---|
| committer | Willy Tarreau <w@1wt.eu> | 2012-10-07 23:40:59 +0200 |
| commit | b49940dcf5f37e5a39c4134f498ca02d13fcac9c (patch) | |
| tree | dfcbddc0bbcc4dd40647b2ffe1f8361961737ba4 | |
| parent | c2b32573f11e15750f7d065c78387c55c785aee2 (diff) | |
| download | lwn-b49940dcf5f37e5a39c4134f498ca02d13fcac9c.tar.gz lwn-b49940dcf5f37e5a39c4134f498ca02d13fcac9c.zip | |
dccp: check ccid before dereferencing
commit 276bdb82dedb290511467a5a4fdbe9f0b52dce6f upstream.
ccid_hc_rx_getsockopt() and ccid_hc_tx_getsockopt() might be called with
a NULL ccid pointer leading to a NULL pointer dereference. This could
lead to a privilege escalation if the attacker is able to map page 0 and
prepare it with a fake ccid_ops pointer.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
| -rw-r--r-- | net/dccp/ccid.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/dccp/ccid.h b/net/dccp/ccid.h index facedd20b531..ab260b0c6b07 100644 --- a/net/dccp/ccid.h +++ b/net/dccp/ccid.h @@ -214,7 +214,7 @@ static inline int ccid_hc_rx_getsockopt(struct ccid *ccid, struct sock *sk, u32 __user *optval, int __user *optlen) { int rc = -ENOPROTOOPT; - if (ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL) + if (ccid != NULL && ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL) rc = ccid->ccid_ops->ccid_hc_rx_getsockopt(sk, optname, len, optval, optlen); return rc; @@ -225,7 +225,7 @@ static inline int ccid_hc_tx_getsockopt(struct ccid *ccid, struct sock *sk, u32 __user *optval, int __user *optlen) { int rc = -ENOPROTOOPT; - if (ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL) + if (ccid != NULL && ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL) rc = ccid->ccid_ops->ccid_hc_tx_getsockopt(sk, optname, len, optval, optlen); return rc; |