Merge "ping: prevent NULL pointer dereference on write to msg_name" (9b9e6bfb) · Commits · e / devices / android_kernel_sony_msm8994

net/ipv4/ping.c

+15 −11

Original line number	Diff line number	Diff line
		@@ -876,10 +876,12 @@ int ping_recvmsg(struct kiocb iocb, struct sock sk, struct msghdr *msg,
		/* Copy the address and add cmsg data. */
		if (family == AF_INET) {
		sin = (struct sockaddr_in *) msg->msg_name;
		if (sin) {
		sin->sin_family = AF_INET;
		sin->sin_port = 0 /* skb->h.uh->source */;
		sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
		memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
		}

		if (isk->cmsg_flags)
		ip_cmsg_recv(msg, skb);
		@@ -889,6 +891,7 @@ int ping_recvmsg(struct kiocb iocb, struct sock sk, struct msghdr *msg,
		struct ipv6_pinfo *np = inet6_sk(sk);
		struct ipv6hdr *ip6 = ipv6_hdr(skb);
		sin6 = (struct sockaddr_in6 *) msg->msg_name;
		if (sin6) {
		sin6->sin6_family = AF_INET6;
		sin6->sin6_port = 0;
		sin6->sin6_addr = ip6->saddr;
		@@ -899,6 +902,7 @@ int ping_recvmsg(struct kiocb iocb, struct sock sk, struct msghdr *msg,

		sin6->sin6_scope_id = ipv6_iface_scope_id(&sin6->sin6_addr,
		IP6CB(skb)->iif);
		}

		if (inet6_sk(sk)->rxopt.all)
		pingv6_ops.ip6_datagram_recv_ctl(sk, msg, skb);