Commit 3ac90216 authored by Eric Sesterhenn's avatar Eric Sesterhenn Committed by David S. Miller
Browse files

[TIPC] Fix for NULL pointer dereference 



This fixes a bug spotted by the coverity checker, bug id #366. If
(mod(seqno - prev) != 1) we set buf to NULL, dereference it in the for
case, and set it to whatever value happes to be at adress 0+next, if it
happens to be non-zero, we even stay in the loop. It seems that the author
intended to break there.

Signed-off-by: default avatarEric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: default avatarPer Liden <per.liden@ericsson.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent a4e09279

net/tipc/bcast.c

+3 −1
Original line number Diff line number Diff line
@@ -349,8 +349,10 @@ static void tipc_bclink_peek_nack(u32 dest, u32 sender_tag, u32 gap_after, u32 g 
		for (; buf; buf = buf->next) {

			u32 seqno = buf_seqno(buf);



			if (mod(seqno - prev) != 1)

			if (mod(seqno - prev) != 1) {

				buf = NULL;

				break;

			}

			if (seqno == gap_after)

				break;

			prev = seqno;