Re: [PATCH net] ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event()
flat view
From: David Miller <davem@davemloft.net>
Date: 2018-03-05 17:00:46
From: Eric Dumazet <redacted> Date: Mon, 05 Mar 2018 08:51:03 -0800
From: Eric Dumazet <redacted>
A tun device type can trivially be set to arbitrary value using
TUNSETLINK ioctl().
Therefore, lowpan_device_event() must really check that ieee802154_ptr
is not NULL.
Fixes: 2c88b5283f60d ("ieee802154: 6lowpan: remove check on null")
Signed-off-by: Eric Dumazet <redacted>
Cc: Alexander Aring <alex.aring@gmail.com>
Cc: Stefan Schmidt <redacted>
Reported-by: syzbot <redacted>Adding linux-wpan list.
quoted hunk ↗ jump to hunk
--- �net/ieee802154/6lowpan/core.c |���12 ++++++++---- �1 file changed, 8 insertions(+), 4 deletions(-)diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c index 974765b7d92a..e9f0489e4229 100644 --- a/net/ieee802154/6lowpan/core.c +++ b/net/ieee802154/6lowpan/core.c@@ -206,9 +206,13 @@ static inline void lowpan_netlink_fini(void) static int lowpan_device_event(struct notifier_block *unused, unsigned long event, void *ptr) { - struct net_device *wdev = netdev_notifier_info_to_dev(ptr); + struct net_device *ndev = netdev_notifier_info_to_dev(ptr); + struct wpan_dev *wpan_dev; - if (wdev->type != ARPHRD_IEEE802154) + if (ndev->type != ARPHRD_IEEE802154) + return NOTIFY_DONE; + wpan_dev = ndev->ieee802154_ptr; + if (!wpan_dev) return NOTIFY_DONE; switch (event) {@@ -217,8 +221,8 @@ static int lowpan_device_event(struct notifier_block *unused, * also delete possible lowpan interfaces which belongs * to the wpan interface. */ - if (wdev->ieee802154_ptr->lowpan_dev) - lowpan_dellink(wdev->ieee802154_ptr->lowpan_dev, NULL); + if (wpan_dev->lowpan_dev) + lowpan_dellink(wpan_dev->lowpan_dev, NULL); break; default: return NOTIFY_DONE;