MIRRORS/linux-imx
1
0
Fork 0
mirror of https://github.com/nxp-imx/linux-imx.git synced 2026-04-20 04:30:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
git.kernel.org/linux-stable/linux-4.20.y
linux-imx/net/rose
History
Bernard Pidoux 32d9062a88 net/rose: fix NULL ax25_cb kernel panic 
[ Upstream commit b0cf029234 ]

When an internally generated frame is handled by rose_xmit(),
rose_route_frame() is called:

        if (!rose_route_frame(skb, NULL)) {
                dev_kfree_skb(skb);
                stats->tx_errors++;
                return NETDEV_TX_OK;
        }

We have the same code sequence in Net/Rom where an internally generated
frame is handled by nr_xmit() calling nr_route_frame(skb, NULL).
However, in this function NULL argument is tested while it is not in
rose_route_frame().
Then kernel panic occurs later on when calling ax25cmp() with a NULL
ax25_cb argument as reported many times and recently with syzbot.

We need to test if ax25 is NULL before using it.

Testing:
Built kernel with CONFIG_ROSE=y.

Signed-off-by: Bernard Pidoux <f6bvp@free.fr>
Acked-by: Dmitry Vyukov <dvyukov@google.com>
Reported-by: syzbot+1a2c456a1ea08fa5b5f7@syzkaller.appspotmail.com
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Bernard Pidoux <f6bvp@free.fr>
Cc: linux-hams@vger.kernel.org
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-06 17:27:36 +01:00
..
af_rose.c Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL 2018-06-28 10:40:47 -07:00
Makefile
rose_dev.c net: Kill dev_rebuild_header 2015-03-02 16:43:41 -05:00
rose_in.c net: rose: mark expected switch fall-throughs 2017-10-22 02:02:26 +01:00
rose_link.c treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts 2017-11-21 16:35:54 -08:00
rose_loopback.c net/rose: Convert timers to use timer_setup() 2017-10-18 12:39:36 +01:00
rose_out.c Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
rose_route.c net/rose: fix NULL ax25_cb kernel panic 2019-02-06 17:27:36 +01:00
rose_subr.c net: cleanup unsigned to unsigned int 2012-04-15 12:44:40 -04:00
rose_timer.c treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts 2017-11-21 16:35:54 -08:00
sysctl_net_rose.c net: Convert uses of typedef ctl_table to struct ctl_table 2013-06-13 02:36:09 -07:00