tipc: Fix NULL pointer dereference in __tipc_sendstream()

tipc_sendstream() may send zero length packet, then tipc_msg_append()
do not alloc skb, skb_peek_tail() will get NULL, msg_set_ack_required
will trigger NULL pointer dereference.

Reported-by: syzbot+8eac6d030e7807c21d32@syzkaller.appspotmail.com
Fixes: 0a3e060f340d ("tipc: add test for Nagle algorithm effectiveness")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 3734cdbedc9cca8c7e85629e2ac910e620d93d70..26123f4177fd2e281f5b47a59e053d9d7cb1af61 100644 (file)
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1588,8 +1588,12 @@ static int __tipc_sendstream(struct socket *sock, struct msghdr *m, size_t dlen)
                                tsk->pkt_cnt += skb_queue_len(txq);
                        } else {
                                skb = skb_peek_tail(txq);
-                               msg_set_ack_required(buf_msg(skb));
-                               tsk->expect_ack = true;
+                               if (skb) {
+                                       msg_set_ack_required(buf_msg(skb));
+                                       tsk->expect_ack = true;
+                               } else {
+                                       tsk->expect_ack = false;
+                               }
                                tsk->msg_acc = 0;
                                tsk->pkt_cnt = 0;
                        }