Re: Null dereference in socket.c

On Fri, 28 Sep 2007 16:00:57 -0700 (PDT)
David Miller [off-list ref] wrote:

From: Chuck Ebbert <redacted>
Date: Fri, 28 Sep 2007 18:58:36 -0400

quoted

After debugging an oops (https://bugzilla.redhat.com/attachment.cgi?id=209231)
I find it happens here in socket.c::sock_ioctl() line 902:

               default:
=============>          err = sock->ops->ioctl(sock, cmd, arg);

                        /*
                         * If this ioctl is unknown try to hand it down
                         * to the NIC driver.
                         */
                        if (err == -ENOIOCTLCMD)
                                err = dev_ioctl(cmd, argp);
                        break;


ioctl is NULL and the kernel jumps to address 0. Should we add a check
for that?

Bug report:
https://bugzilla.redhat.com/show_bug.cgi?id=306801

Every protocol should provide a non-NULL ->ioctl() method,
find out which one isn't and fix it

Auditing the net-2.6.24 tree all instances found by cscope are safe.

	


-- 
Stephen Hemminger [off-list ref]