From patchwork Mon Jun 13 10:25:19 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andy Whitcroft X-Patchwork-Id: 100155 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id 8BB53B6FC4 for ; Mon, 13 Jun 2011 20:25:33 +1000 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1QW4Ki-0004yA-EW; Mon, 13 Jun 2011 10:25:24 +0000 Received: from adelie.canonical.com ([91.189.90.139]) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1QW4Kg-0004y3-E1 for kernel-team@lists.ubuntu.com; Mon, 13 Jun 2011 10:25:22 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by adelie.canonical.com with esmtp (Exim 4.71 #1 (Debian)) id 1QW4Kg-0006vu-B6; Mon, 13 Jun 2011 10:25:22 +0000 Received: from 212-139-215-176.dynamic.dsl.as9105.com ([212.139.215.176] helo=localhost.localdomain) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1QW4Kg-0000jc-7l; Mon, 13 Jun 2011 10:25:22 +0000 From: Andy Whitcroft To: kernel-team@lists.ubuntu.com Subject: [lucid/fsl-imx51, maverick, maverick/ti-omap4, natty/ti-omap4 CVE 1/1] can: Add missing socket check in can/bcm release. Date: Mon, 13 Jun 2011 11:25:19 +0100 Message-Id: <1307960719-21404-1-git-send-email-apw@canonical.com> X-Mailer: git-send-email 1.7.4.1 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.13 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com From: Dave Jones We can get here with a NULL socket argument passed from userspace, so we need to handle it accordingly. Signed-off-by: Dave Jones Signed-off-by: David S. Miller (cherry picked from commit c6914a6f261aca0c9f715f883a353ae7ff51fe83) CVE-2011-1598 BugLink: http://bugs.launchpad.net/bugs/796502 Signed-off-by: Andy Whitcroft --- net/can/bcm.c | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-) diff --git a/net/can/bcm.c b/net/can/bcm.c index 9d5e8ac..56d20a2 100644 --- a/net/can/bcm.c +++ b/net/can/bcm.c @@ -1424,9 +1424,14 @@ static int bcm_init(struct sock *sk) static int bcm_release(struct socket *sock) { struct sock *sk = sock->sk; - struct bcm_sock *bo = bcm_sk(sk); + struct bcm_sock *bo; struct bcm_op *op, *next; + if (sk == NULL) + return 0; + + bo = bcm_sk(sk); + /* remove bcm_ops, timer, rx_unregister(), etc. */ unregister_netdevice_notifier(&bo->notifier);