Thread (10 messages) flat view 10 messages, 3 authors, 2021-02-24

Re: [PATCH wpan 4/4] net: ieee802154: fix nl802154 del llsec devkey

From: Stefan Schmidt <stefan@datenfreihafen.org>
Date: 2021-02-24 15:20:05

Hello.

On 21.02.21 18:43, Alexander Aring wrote:
quoted hunk ↗ jump to hunk
This patch fixes a nullpointer dereference if NL802154_ATTR_SEC_DEVKEY is
not set by the user. If this is the case nl802154 will return -EINVAL.

Reported-by: syzbot+368672e0da240db53b5f@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
---
  net/ieee802154/nl802154.c | 3 ++-
  1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index 3f6d86d63923..e9e4652cd592 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -1916,7 +1916,8 @@ static int nl802154_del_llsec_devkey(struct sk_buff *skb, struct genl_info *info
  	struct ieee802154_llsec_device_key key;
  	__le64 extended_addr;
  
-	if (nla_parse_nested_deprecated(attrs, NL802154_DEVKEY_ATTR_MAX, info->attrs[NL802154_ATTR_SEC_DEVKEY], nl802154_devkey_policy, info->extack))
+	if (!info->attrs[NL802154_ATTR_SEC_DEVKEY] ||
+	    nla_parse_nested_deprecated(attrs, NL802154_DEVKEY_ATTR_MAX, info->attrs[NL802154_ATTR_SEC_DEVKEY], nl802154_devkey_policy, info->extack))
  		return -EINVAL;
  
  	if (!attrs[NL802154_DEVKEY_ATTR_EXTENDED_ADDR])
This patch has been applied to the wpan tree and will be
part of the next pull request to net. Thanks!

regards
Stefan Schmidt
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help