summaryrefslogtreecommitdiff
path: root/net/ax25/ax25_dev.c
diff options
context:
space:
mode:
authorCong Wang <xiyou.wangcong@gmail.com>2018-12-30 00:56:36 +0300
committerDavid S. Miller <davem@davemloft.net>2018-12-31 01:07:54 +0300
commitc433570458e49bccea5c551df628d058b3526289 (patch)
tree05427f71af7a74fb15b0eb08f138cc6004a225c1 /net/ax25/ax25_dev.c
parent7f334a7e1ae113212e39aafba51352ea9ab8c9f9 (diff)
downloadlinux-c433570458e49bccea5c551df628d058b3526289.tar.xz
ax25: fix a use-after-free in ax25_fillin_cb()
There are multiple issues here: 1. After freeing dev->ax25_ptr, we need to set it to NULL otherwise we may use a dangling pointer. 2. There is a race between ax25_setsockopt() and device notifier as reported by syzbot. Close it by holding RTNL lock. 3. We need to test if dev->ax25_ptr is NULL before using it. Reported-and-tested-by: syzbot+ae6bb869cbed29b29040@syzkaller.appspotmail.com Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ax25/ax25_dev.c')
-rw-r--r--net/ax25/ax25_dev.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c
index 9a3a301e1e2f..d92195cd7834 100644
--- a/net/ax25/ax25_dev.c
+++ b/net/ax25/ax25_dev.c
@@ -116,6 +116,7 @@ void ax25_dev_device_down(struct net_device *dev)
if ((s = ax25_dev_list) == ax25_dev) {
ax25_dev_list = s->next;
spin_unlock_bh(&ax25_dev_lock);
+ dev->ax25_ptr = NULL;
dev_put(dev);
kfree(ax25_dev);
return;
@@ -125,6 +126,7 @@ void ax25_dev_device_down(struct net_device *dev)
if (s->next == ax25_dev) {
s->next = ax25_dev->next;
spin_unlock_bh(&ax25_dev_lock);
+ dev->ax25_ptr = NULL;
dev_put(dev);
kfree(ax25_dev);
return;