diff options
| author | Bernard Pidoux <[email protected]> | 2019-01-25 11:46:40 +0100 |
|---|---|---|
| committer | David S. Miller <[email protected]> | 2019-01-27 10:40:01 -0800 |
| commit | b0cf029234f9b18e10703ba5147f0389c382bccc (patch) | |
| tree | ce465f39a10f701dcc03cca11e152d7e1b6bd80a | |
| parent | 6571ebce112a21ec9be68ef2f53b96fcd41fd81b (diff) | |
net/rose: fix NULL ax25_cb kernel panic
When an internally generated frame is handled by rose_xmit(),
rose_route_frame() is called:
if (!rose_route_frame(skb, NULL)) {
dev_kfree_skb(skb);
stats->tx_errors++;
return NETDEV_TX_OK;
}
We have the same code sequence in Net/Rom where an internally generated
frame is handled by nr_xmit() calling nr_route_frame(skb, NULL).
However, in this function NULL argument is tested while it is not in
rose_route_frame().
Then kernel panic occurs later on when calling ax25cmp() with a NULL
ax25_cb argument as reported many times and recently with syzbot.
We need to test if ax25 is NULL before using it.
Testing:
Built kernel with CONFIG_ROSE=y.
Signed-off-by: Bernard Pidoux <[email protected]>
Acked-by: Dmitry Vyukov <[email protected]>
Reported-by: [email protected]
Cc: "David S. Miller" <[email protected]>
Cc: Ralf Baechle <[email protected]>
Cc: Bernard Pidoux <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Signed-off-by: David S. Miller <[email protected]>
| -rw-r--r-- | net/rose/rose_route.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c index 77e9f85a2c92..f2ff21d7df08 100644 --- a/net/rose/rose_route.c +++ b/net/rose/rose_route.c @@ -850,6 +850,7 @@ void rose_link_device_down(struct net_device *dev) /* * Route a frame to an appropriate AX.25 connection. + * A NULL ax25_cb indicates an internally generated frame. */ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25) { @@ -867,6 +868,10 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25) if (skb->len < ROSE_MIN_LEN) return res; + + if (!ax25) + return rose_loopback_queue(skb, NULL); + frametype = skb->data[2]; lci = ((skb->data[0] << 8) & 0xF00) + ((skb->data[1] << 0) & 0x0FF); if (frametype == ROSE_CALL_REQUEST && |