Messages in this thread | | | Date | Thu, 15 Oct 2020 07:12:25 +0200 | From | Greg KH <> | Subject | Re: [Linux-kernel-mentees] [PATCH] net: rose: Fix Null pointer dereference in rose_send_frame() |
| |
On Thu, Oct 15, 2020 at 05:47:12AM +0530, Anmol Karn wrote: > In rose_send_frame(), when comparing two ax.25 addresses, it assigns rose_call to > either global ROSE callsign or default port, but when the former block triggers and > rose_call is assigned by (ax25_address *)neigh->dev->dev_addr, a NULL pointer is > dereferenced by 'neigh' when dereferencing 'dev'. > > - net/rose/rose_link.c > This bug seems to get triggered in this line: > > rose_call = (ax25_address *)neigh->dev->dev_addr; > > Prevent it by checking NULL condition for neigh->dev before comparing addressed for > rose_call initialization. > > Reported-by: syzbot+a1c743815982d9496393@syzkaller.appspotmail.com > Link: https://syzkaller.appspot.com/bug?id=9d2a7ca8c7f2e4b682c97578dfa3f236258300b3 > Signed-off-by: Anmol Karn <anmol.karan123@gmail.com> > --- > I am bit sceptical about the error return code, please suggest if anything else is > appropriate in place of '-ENODEV'. > > net/rose/rose_link.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/net/rose/rose_link.c b/net/rose/rose_link.c > index f6102e6f5161..92ea6a31d575 100644 > --- a/net/rose/rose_link.c > +++ b/net/rose/rose_link.c > @@ -97,6 +97,9 @@ static int rose_send_frame(struct sk_buff *skb, struct rose_neigh *neigh) > ax25_address *rose_call; > ax25_cb *ax25s; > > + if (!neigh->dev) > + return -ENODEV;
How can ->dev not be set at this point in time? Shouldn't that be fixed, because it could change right after you check this, right?
thanks,
greg k-h
| |