diff options
| author | Cong Wang <xiyou.wangcong@gmail.com> | 2018-12-29 13:56:36 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-12-30 14:07:54 -0800 |
| commit | c433570458e49bccea5c551df628d058b3526289 (patch) | |
| tree | 05427f71af7a74fb15b0eb08f138cc6004a225c1 /net/ax25/ax25_dev.c | |
| parent | 7f334a7e1ae113212e39aafba51352ea9ab8c9f9 (diff) | |
| download | linux-c433570458e49bccea5c551df628d058b3526289.tar.gz | |
ax25: fix a use-after-free in ax25_fillin_cb()
There are multiple issues here: 1. After freeing dev->ax25_ptr, we need to set it to NULL otherwise we may use a dangling pointer. 2. There is a race between ax25_setsockopt() and device notifier as reported by syzbot. Close it by holding RTNL lock. 3. We need to test if dev->ax25_ptr is NULL before using it. Reported-and-tested-by: syzbot+ae6bb869cbed29b29040@syzkaller.appspotmail.com Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ax25/ax25_dev.c')
| -rw-r--r-- | net/ax25/ax25_dev.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c index 9a3a301e1e2f..d92195cd7834 100644 --- a/net/ax25/ax25_dev.c +++ b/net/ax25/ax25_dev.c @@ -116,6 +116,7 @@ void ax25_dev_device_down(struct net_device *dev) if ((s = ax25_dev_list) == ax25_dev) { ax25_dev_list = s->next; spin_unlock_bh(&ax25_dev_lock); + dev->ax25_ptr = NULL; dev_put(dev); kfree(ax25_dev); return; @@ -125,6 +126,7 @@ void ax25_dev_device_down(struct net_device *dev) if (s->next == ax25_dev) { s->next = ax25_dev->next; spin_unlock_bh(&ax25_dev_lock); + dev->ax25_ptr = NULL; dev_put(dev); kfree(ax25_dev); return; |