3 ms·
At least if I'm thinking of the same bug the code was this [0]: static unsigned int tun_chr_poll(struct file *file, poll_table * wait) { struct tun_fi
by aw1621107 7y ago
At least if I'm thinking of the same bug the code was this [0]:
static unsigned int tun_chr_poll(struct file *file, poll_table * wait)
{
struct tun_file *tfile = file->private_data;
struct tun_struct *tun = __tun_get(tfile);
struct sock *sk = tun->sk; // Dereference before null check!
unsigned int mask = 0;
if (!tun)
return POLLERR;
I haven't been able to find Linus's rant, so I'm not totally convinced that I have the right thing.
[0]: https://lwn.net/Articles/342330/ https://lwn.net/Articles/342330/