From: Steffen Klassert <steffen.klassert@secunet.com>
Date: Tue, 8 Oct 2013 08:49:51 +0000 (+0200)
Subject: xfrm: check for a vaild skb in xfrm_policy_queue_process
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=2bb53e2557964c2c5368a0392cf3b3b63a288cd0;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git

xfrm: check for a vaild skb in xfrm_policy_queue_process

We might dreference a NULL pointer if the hold_queue is empty,
so add a check to avoid this.

Bug was introduced with git commit a0073fe18 ("xfrm: Add a state
resolution packet queue")

Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 5f9be976770e..76e1873811d4 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1772,6 +1772,10 @@ static void xfrm_policy_queue_process(unsigned long arg)
 
 	spin_lock(&pq->hold_queue.lock);
 	skb = skb_peek(&pq->hold_queue);
+	if (!skb) {
+		spin_unlock(&pq->hold_queue.lock);
+		goto out;
+	}
 	dst = skb_dst(skb);
 	sk = skb->sk;
 	xfrm_decode_session(skb, &fl, dst->ops->family);