lkml.org 
[lkml]   [2020]   [Dec]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 02/39] rose: Fix Null pointer dereference in rose_send_frame()
    Date
    From: Anmol Karn <anmol.karan123@gmail.com>

    [ Upstream commit 3b3fd068c56e3fbea30090859216a368398e39bf ]

    rose_send_frame() dereferences `neigh->dev` when called from
    rose_transmit_clear_request(), and the first occurrence of the
    `neigh` is in rose_loopback_timer() as `rose_loopback_neigh`,
    and it is initialized in rose_add_loopback_neigh() as NULL.
    i.e when `rose_loopback_neigh` used in rose_loopback_timer()
    its `->dev` was still NULL and rose_loopback_timer() was calling
    rose_rx_call_request() without checking for NULL.

    - net/rose/rose_link.c
    This bug seems to get triggered in this line:

    rose_call = (ax25_address *)neigh->dev->dev_addr;

    Fix it by adding NULL checking for `rose_loopback_neigh->dev`
    in rose_loopback_timer().

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Suggested-by: Jakub Kicinski <kuba@kernel.org>
    Reported-by: syzbot+a1c743815982d9496393@syzkaller.appspotmail.com
    Tested-by: syzbot+a1c743815982d9496393@syzkaller.appspotmail.com
    Link: https://syzkaller.appspot.com/bug?id=9d2a7ca8c7f2e4b682c97578dfa3f236258300b3
    Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
    Link: https://lore.kernel.org/r/20201119191043.28813-1-anmol.karan123@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/rose/rose_loopback.c | 17 +++++++++++++----
    1 file changed, 13 insertions(+), 4 deletions(-)

    --- a/net/rose/rose_loopback.c
    +++ b/net/rose/rose_loopback.c
    @@ -99,10 +99,19 @@ static void rose_loopback_timer(unsigned
    }

    if (frametype == ROSE_CALL_REQUEST) {
    - if ((dev = rose_dev_get(dest)) != NULL) {
    - if (rose_rx_call_request(skb, dev, rose_loopback_neigh, lci_o) == 0)
    - kfree_skb(skb);
    - } else {
    + if (!rose_loopback_neigh->dev) {
    + kfree_skb(skb);
    + continue;
    + }
    +
    + dev = rose_dev_get(dest);
    + if (!dev) {
    + kfree_skb(skb);
    + continue;
    + }
    +
    + if (rose_rx_call_request(skb, dev, rose_loopback_neigh, lci_o) == 0) {
    + dev_put(dev);
    kfree_skb(skb);
    }
    } else {

    \
     
     \ /
      Last update: 2020-12-10 20:37    [W:4.262 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site