]> www.infradead.org Git - users/jedix/linux-maple.git/commit
ax25: fix a use-after-free in ax25_fillin_cb()
authorCong Wang <xiyou.wangcong@gmail.com>
Sat, 29 Dec 2018 21:56:36 +0000 (13:56 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 9 Jan 2019 16:14:43 +0000 (17:14 +0100)
commit26a5adc8eb26d170058645c3cccd4d19165bec16
tree655ad893e92d5f06307bac375e35a732079912fb
parent18e260fd2a4c7433e2daa861678f2dd58501904b
ax25: fix a use-after-free in ax25_fillin_cb()

[ Upstream commit c433570458e49bccea5c551df628d058b3526289 ]

There are multiple issues here:

1. After freeing dev->ax25_ptr, we need to set it to NULL otherwise
   we may use a dangling pointer.

2. There is a race between ax25_setsockopt() and device notifier as
   reported by syzbot. Close it by holding RTNL lock.

3. We need to test if dev->ax25_ptr is NULL before using it.

Reported-and-tested-by: syzbot+ae6bb869cbed29b29040@syzkaller.appspotmail.com
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/ax25/af_ax25.c
net/ax25/ax25_dev.c