From: Eric Dumazet <eric.dumazet@xxxxxxxxx>
Date: Mon, 05 Mar 2018 08:51:03 -0800
> From: Eric Dumazet <edumazet@xxxxxxxxxx>
>
> A tun device type can trivially be set to arbitrary value using
> TUNSETLINK ioctl().
>
> Therefore, lowpan_device_event() must really check that ieee802154_ptr
> is not NULL.
>
> Fixes: 2c88b5283f60d ("ieee802154: 6lowpan: remove check on null")
> Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx>
> Cc: Alexander Aring <alex.aring@xxxxxxxxx>
> Cc: Stefan Schmidt <stefan@xxxxxxxxxxxxxxx>
> Reported-by: syzbot <syzkaller@xxxxxxxxxxxxxxxx>
Adding linux-wpan list.
> ---
> net/ieee802154/6lowpan/core.c | 12 ++++++++----
> 1 file changed, 8 insertions(+), 4 deletions(-)
>
> diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c
> index 974765b7d92a..e9f0489e4229 100644
> --- a/net/ieee802154/6lowpan/core.c
> +++ b/net/ieee802154/6lowpan/core.c
> @@ -206,9 +206,13 @@ static inline void lowpan_netlink_fini(void)
> static int lowpan_device_event(struct notifier_block *unused,
> unsigned long event, void *ptr)
> {
> - struct net_device *wdev = netdev_notifier_info_to_dev(ptr);
> + struct net_device *ndev = netdev_notifier_info_to_dev(ptr);
> + struct wpan_dev *wpan_dev;
>
> - if (wdev->type != ARPHRD_IEEE802154)
> + if (ndev->type != ARPHRD_IEEE802154)
> + return NOTIFY_DONE;
> + wpan_dev = ndev->ieee802154_ptr;
> + if (!wpan_dev)
> return NOTIFY_DONE;
>
> switch (event) {
> @@ -217,8 +221,8 @@ static int lowpan_device_event(struct notifier_block *unused,
> * also delete possible lowpan interfaces which belongs
> * to the wpan interface.
> */
> - if (wdev->ieee802154_ptr->lowpan_dev)
> - lowpan_dellink(wdev->ieee802154_ptr->lowpan_dev, NULL);
> + if (wpan_dev->lowpan_dev)
> + lowpan_dellink(wpan_dev->lowpan_dev, NULL);
> break;
> default:
> return NOTIFY_DONE;
>
--
To unsubscribe from this list: send the line "unsubscribe linux-wpan" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
