rose: Fix Null pointer dereference in rose_send_frame()
rose_send_frame() dereferences `neigh->dev` when called from rose_transmit_clear_request(), and the first occurrence of the `neigh` is in rose_loopback_timer() as `rose_loopback_neigh`, and it is initialized in rose_add_loopback_neigh() as NULL. i.e when `rose_loopback_neigh` used in rose_loopback_timer() its `->dev` was still NULL and rose_loopback_timer() was calling rose_rx_call_request() without checking for NULL. - net/rose/rose_link.c This bug seems to get triggered in this line: rose_call = (ax25_address *)neigh->dev->dev_addr; Fix it by adding NULL checking for `rose_loopback_neigh->dev` in rose_loopback_timer(). Fixes: 1da177e4 ("Linux-2.6.12-rc2") Suggested-by:Jakub Kicinski <kuba@kernel.org> Reported-by:
<syzbot+a1c743815982d9496393@syzkaller.appspotmail.com> Tested-by:
<syzbot+a1c743815982d9496393@syzkaller.appspotmail.com> Link: https://syzkaller.appspot.com/bug?id=9d2a7ca8c7f2e4b682c97578dfa3f236258300b3 Signed-off-by: Anmol Karn <...
parent
f46e79aa
-
mentioned in commit de3deadd
-
mentioned in commit 9cf85759
-
mentioned in commit b8f9de19
-
mentioned in commit 0aae33fe
-
mentioned in commit 76885373
-
mentioned in commit 6e4b20d5
-
mentioned in commit bbc03d74
-
mentioned in commit 5b46adfb
-
mentioned in commit 01b9c68c
-
mentioned in commit f06186e5
-
mentioned in commit b13be5e8
Please register or sign in to comment