Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0977763a authored by YueHaibing's avatar YueHaibing Committed by Greg Kroah-Hartman
Browse files

appletalk: Fix potential NULL pointer dereference in unregister_snap_client 



commit 9804501fa1228048857910a6bf23e085aade37cc upstream.

register_snap_client may return NULL, all the callers
check it, but only print a warning. This will result in
NULL pointer dereference in unregister_snap_client and other
places.

It has always been used like this since v2.6

Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarYueHaibing <yuehaibing@huawei.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 754e3c0c

include/linux/atalk.h

+1 −1
Original line number Original line Diff line number Diff line
@@ -108,7 +108,7 @@ static __inline__ struct elapaarp *aarp_hdr(struct sk_buff *skb) 
#define AARP_RESOLVE_TIME	(10 * HZ)

#define AARP_RESOLVE_TIME	(10 * HZ)





extern struct datalink_proto *ddp_dl, *aarp_dl;

extern struct datalink_proto *ddp_dl, *aarp_dl;

extern void aarp_proto_init(void);

extern int aarp_proto_init(void);





/* Inter module exports */

/* Inter module exports */

net/appletalk/aarp.c

+12 −3
Original line number Original line Diff line number Diff line
@@ -879,15 +879,24 @@ static struct notifier_block aarp_notifier = { 




static unsigned char aarp_snap_id[] = { 0x00, 0x00, 0x00, 0x80, 0xF3 };

static unsigned char aarp_snap_id[] = { 0x00, 0x00, 0x00, 0x80, 0xF3 };





void __init aarp_proto_init(void)

int __init aarp_proto_init(void)

{

{

	int rc;



	aarp_dl = register_snap_client(aarp_snap_id, aarp_rcv);

	aarp_dl = register_snap_client(aarp_snap_id, aarp_rcv);

	if (!aarp_dl)

	if (!aarp_dl) {

		printk(KERN_CRIT "Unable to register AARP with SNAP.\n");

		printk(KERN_CRIT "Unable to register AARP with SNAP.\n");

		return -ENOMEM;

	}

	timer_setup(&aarp_timer, aarp_expire_timeout, 0);

	timer_setup(&aarp_timer, aarp_expire_timeout, 0);

	aarp_timer.expires  = jiffies + sysctl_aarp_expiry_time;

	aarp_timer.expires  = jiffies + sysctl_aarp_expiry_time;

	add_timer(&aarp_timer);

	add_timer(&aarp_timer);

	register_netdevice_notifier(&aarp_notifier);

	rc = register_netdevice_notifier(&aarp_notifier);

	if (rc) {

		del_timer_sync(&aarp_timer);

		unregister_snap_client(aarp_dl);

	}

	return rc;

}

}





/* Remove the AARP entries associated with a device. */

/* Remove the AARP entries associated with a device. */

net/appletalk/ddp.c

+12 −8
Original line number Original line Diff line number Diff line
@@ -1909,9 +1909,6 @@ static unsigned char ddp_snap_id[] = { 0x08, 0x00, 0x07, 0x80, 0x9B }; 
EXPORT_SYMBOL(atrtr_get_dev);

EXPORT_SYMBOL(atrtr_get_dev);

EXPORT_SYMBOL(atalk_find_dev_addr);

EXPORT_SYMBOL(atalk_find_dev_addr);





static const char atalk_err_snap[] __initconst =

	KERN_CRIT "Unable to register DDP with SNAP.\n";



/* Called by proto.c on kernel start up */

/* Called by proto.c on kernel start up */

static int __init atalk_init(void)

static int __init atalk_init(void)

{

{
@@ -1926,17 +1923,22 @@ static int __init atalk_init(void) 
		goto out_proto;

		goto out_proto;





	ddp_dl = register_snap_client(ddp_snap_id, atalk_rcv);

	ddp_dl = register_snap_client(ddp_snap_id, atalk_rcv);

	if (!ddp_dl)

	if (!ddp_dl) {

		printk(atalk_err_snap);

		pr_crit("Unable to register DDP with SNAP.\n");

		goto out_sock;

	}





	dev_add_pack(&ltalk_packet_type);

	dev_add_pack(&ltalk_packet_type);

	dev_add_pack(&ppptalk_packet_type);

	dev_add_pack(&ppptalk_packet_type);





	rc = register_netdevice_notifier(&ddp_notifier);

	rc = register_netdevice_notifier(&ddp_notifier);

	if (rc)

	if (rc)

		goto out_sock;

		goto out_snap;



	rc = aarp_proto_init();

	if (rc)

		goto out_dev;





	aarp_proto_init();

	rc = atalk_proc_init();

	rc = atalk_proc_init();

	if (rc)

	if (rc)

		goto out_aarp;

		goto out_aarp;
@@ -1950,11 +1952,13 @@ static int __init atalk_init(void) 
	atalk_proc_exit();

	atalk_proc_exit();

out_aarp:

out_aarp:

	aarp_cleanup_module();

	aarp_cleanup_module();

out_dev:

	unregister_netdevice_notifier(&ddp_notifier);

	unregister_netdevice_notifier(&ddp_notifier);

out_sock:

out_snap:

	dev_remove_pack(&ppptalk_packet_type);

	dev_remove_pack(&ppptalk_packet_type);

	dev_remove_pack(&ltalk_packet_type);

	dev_remove_pack(&ltalk_packet_type);

	unregister_snap_client(ddp_dl);

	unregister_snap_client(ddp_dl);

out_sock:

	sock_unregister(PF_APPLETALK);

	sock_unregister(PF_APPLETALK);

out_proto:

out_proto:

	proto_unregister(&ddp_proto);

	proto_unregister(&ddp_proto);