Commit cf970c00 authored by Hannes Frederic Sowa's avatar Hannes Frederic Sowa Committed by David S. Miller
Browse files

ping: prevent NULL pointer dereference on write to msg_name 



A plain read() on a socket does set msg->msg_name to NULL. So check for
NULL pointer first.

Signed-off-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4861292f

net/ipv4/ping.c

+19 −15
Original line number Diff line number Diff line
@@ -870,11 +870,13 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, 
	if (family == AF_INET) {

		struct sockaddr_in *sin = (struct sockaddr_in *)msg->msg_name;



		if (sin) {

			sin->sin_family = AF_INET;

			sin->sin_port = 0 /* skb->h.uh->source */;

			sin->sin_addr.s_addr = ip_hdr(skb)->saddr;

			memset(sin->sin_zero, 0, sizeof(sin->sin_zero));

			*addr_len = sizeof(*sin);

		}



		if (isk->cmsg_flags)

			ip_cmsg_recv(msg, skb);
@@ -886,16 +888,18 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, 
		struct sockaddr_in6 *sin6 =

			(struct sockaddr_in6 *)msg->msg_name;



		if (sin6) {

			sin6->sin6_family = AF_INET6;

			sin6->sin6_port = 0;

			sin6->sin6_addr = ip6->saddr;

			sin6->sin6_flowinfo = 0;

			if (np->sndflow)

				sin6->sin6_flowinfo = ip6_flowinfo(ip6);



		sin6->sin6_scope_id = ipv6_iface_scope_id(&sin6->sin6_addr,

			sin6->sin6_scope_id =

				ipv6_iface_scope_id(&sin6->sin6_addr,

						    IP6CB(skb)->iif);

			*addr_len = sizeof(*sin6);

		}



		if (inet6_sk(sk)->rxopt.all)

			pingv6_ops.ip6_datagram_recv_ctl(sk, msg, skb);