ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event()
[ Upstream commitpull/10/headca0edb131b
] A tun device type can trivially be set to arbitrary value using TUNSETLINK ioctl(). Therefore, lowpan_device_event() must really check that ieee802154_ptr is not NULL. Fixes:2c88b5283f
("ieee802154: 6lowpan: remove check on null") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Alexander Aring <alex.aring@gmail.com> Cc: Stefan Schmidt <stefan@osg.samsung.com> Reported-by: syzbot <syzkaller@googlegroups.com> Acked-by: Stefan Schmidt <stefan@osg.samsung.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
f77ff13a06
commit
f6cdb675ca
|
@ -206,9 +206,13 @@ static inline void lowpan_netlink_fini(void)
|
|||
static int lowpan_device_event(struct notifier_block *unused,
|
||||
unsigned long event, void *ptr)
|
||||
{
|
||||
struct net_device *wdev = netdev_notifier_info_to_dev(ptr);
|
||||
struct net_device *ndev = netdev_notifier_info_to_dev(ptr);
|
||||
struct wpan_dev *wpan_dev;
|
||||
|
||||
if (wdev->type != ARPHRD_IEEE802154)
|
||||
if (ndev->type != ARPHRD_IEEE802154)
|
||||
return NOTIFY_DONE;
|
||||
wpan_dev = ndev->ieee802154_ptr;
|
||||
if (!wpan_dev)
|
||||
return NOTIFY_DONE;
|
||||
|
||||
switch (event) {
|
||||
|
@ -217,8 +221,8 @@ static int lowpan_device_event(struct notifier_block *unused,
|
|||
* also delete possible lowpan interfaces which belongs
|
||||
* to the wpan interface.
|
||||
*/
|
||||
if (wdev->ieee802154_ptr->lowpan_dev)
|
||||
lowpan_dellink(wdev->ieee802154_ptr->lowpan_dev, NULL);
|
||||
if (wpan_dev->lowpan_dev)
|
||||
lowpan_dellink(wpan_dev->lowpan_dev, NULL);
|
||||
break;
|
||||
default:
|
||||
return NOTIFY_DONE;
|
||||
|
|
Loading…
Reference in New Issue