From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756818AbdIHRq2 (ORCPT ); Fri, 8 Sep 2017 13:46:28 -0400 Received: from mo4-p00-ob.smtp.rzone.de ([81.169.146.219]:32806 "EHLO mo4-p00-ob.smtp.rzone.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756770AbdIHRqZ (ORCPT ); Fri, 8 Sep 2017 13:46:25 -0400 X-RZG-AUTH: :P2MHfkW8eP4Mre39l357AZT/I7AY/7nT2yrT1q0ngWNsKR9DbcDvsfbZ70J0gsQNRtvkOg== X-RZG-CLASS-ID: mo00 Subject: Re: [PATCH] can: check for null sk before deferencing it via the call to sock_net To: Colin King , Marc Kleine-Budde , "David S . Miller" , linux-can@vger.kernel.org, netdev@vger.kernel.org Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org References: <20170908150235.2931-1-colin.king@canonical.com> From: Oliver Hartkopp Message-ID: Date: Fri, 8 Sep 2017 19:46:13 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1 MIME-Version: 1.0 In-Reply-To: <20170908150235.2931-1-colin.king@canonical.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 09/08/2017 05:02 PM, Colin King wrote: > From: Colin Ian King > > The assignment of net via call sock_net will dereference sk. This > is performed before a sanity null check on sk, so there could be > a potential null dereference on the sock_net call if sk is null. > Fix this by assigning net after the sk null check. Also replace > the sk == NULL with the more usual !sk idiom. > > Detected by CoverityScan CID#1431862 ("Dereference before null check") > > Fixes: 384317ef4187 ("can: network namespace support for CAN_BCM protocol") > Signed-off-by: Colin Ian King Acked-by: Oliver Hartkopp Thanks Collin! > --- > net/can/bcm.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/net/can/bcm.c b/net/can/bcm.c > index 47a8748d953a..a3791674b8ce 100644 > --- a/net/can/bcm.c > +++ b/net/can/bcm.c > @@ -1493,13 +1493,14 @@ static int bcm_init(struct sock *sk) > static int bcm_release(struct socket *sock) > { > struct sock *sk = sock->sk; > - struct net *net = sock_net(sk); > + struct net *net; > struct bcm_sock *bo; > struct bcm_op *op, *next; > > - if (sk == NULL) > + if (!sk) > return 0; > > + net = sock_net(sk); > bo = bcm_sk(sk); > > /* remove bcm_ops, timer, rx_unregister(), etc. */ >