• Bernard Pidoux's avatar
    net/rose: fix NULL ax25_cb kernel panic · 32d9062a
    Bernard Pidoux authored
    [ Upstream commit b0cf0292 ]
    
    When an internally generated frame is handled by rose_xmit(),
    rose_route_frame() is called:
    
            if (!rose_route_frame(skb, NULL)) {
                    dev_kfree_skb(skb);
                    stats->tx_errors++;
                    return NETDEV_TX_OK;
            }
    
    We have the same code sequence in Net/Rom where an internally generated
    frame is handled by nr_xmit() calling nr_route_frame(skb, NULL).
    However, in this function NULL argument is tested while it is not in
    rose_route_frame().
    Then kernel panic occurs later on when calling ax25cmp() with a NULL
    ax25_cb argument as reported many times and recently with syzbot.
    
    We need to test if ax25 is NULL before using it.
    
    Testing:
    Built kernel with CONFIG_ROSE=y.
    Signed-off-by: 's avatarBernard Pidoux <f6bvp@free.fr>
    Acked-by: 's avatarDmitry Vyukov <dvyukov@google.com>
    Reported-by: syzbot+1a2c456a1ea08fa5b5f7@syzkaller.appspotmail.com
    Cc: "David S. Miller" <davem@davemloft.net>
    Cc: Ralf Baechle <ralf@linux-mips.org>
    Cc: Bernard Pidoux <f6bvp@free.fr>
    Cc: linux-hams@vger.kernel.org
    Cc: netdev@vger.kernel.org
    Cc: linux-kernel@vger.kernel.org
    Signed-off-by: 's avatarDavid S. Miller <davem@davemloft.net>
    Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    32d9062a
Name
Last commit
Last update
..
Makefile Loading commit data...
af_rose.c Loading commit data...
rose_dev.c Loading commit data...
rose_in.c Loading commit data...
rose_link.c Loading commit data...
rose_loopback.c Loading commit data...
rose_out.c Loading commit data...
rose_route.c Loading commit data...
rose_subr.c Loading commit data...
rose_timer.c Loading commit data...
sysctl_net_rose.c Loading commit data...