Message ID | 20090706074835.3fe641f0@mako-desktop |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
From: Mariusz Kozlowski <m.kozlowski@tuxland.pl> Date: Mon, 6 Jul 2009 07:48:35 +0200 > Fix NULL pointer dereference in tun_chr_pool() introduced by > commit 33dccbb050bbe35b88ca8cf1228dcf3e4d4b3554 and triggered > by this code: > > int fd; > struct pollfd pfd; > fd = open("/dev/net/tun", O_RDWR); > pfd.fd = fd; > pfd.events = POLLIN | POLLOUT; > poll(&pfd, 1, 0); > > Reported-by: Eugene Kapun <abacabadabacaba@gmail.com> > Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl> Applied, thanks! -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/net/tun.c b/drivers/net/tun.c index a1b0697..bcbb25e 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -482,12 +482,14 @@ static unsigned int tun_chr_poll(struct file *file, poll_table * wait) { struct tun_file *tfile = file->private_data; struct tun_struct *tun = __tun_get(tfile); - struct sock *sk = tun->sk; + struct sock *sk; unsigned int mask = 0; if (!tun) return POLLERR; + sk = tun->sk; + DBG(KERN_INFO "%s: tun_chr_poll\n", tun->dev->name); poll_wait(file, &tfile->read_wait, wait);