d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix a logic error in uipc_ready_scan().

Browse Source 
When processing the last record in a socket buffer, take care to avoid a
NULL pointer dereference when advancing the record iterator.

Reported by:	syzbot+6a689cc9c27bd265237a@syzkaller.appspotmail.com
Fixes:		r359778
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
This commit is contained in:
Mark Johnston 2020-07-30 00:52:37 +00:00
parent d2090a40d0
commit 1b778ba260
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=363682
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sys/kern/uipc_usrreq.c
View File

@ -1279,7 +1279,8 @@ uipc_ready_scan(struct socket *so, struct mbuf *m, int count, int *errorp)
mb = mb->m_next;
if (mb == NULL) {
mb = n;
n = mb->m_nextpkt;
if (mb != NULL)
n = mb->m_nextpkt;
}
}
}