Hello.
On 03/05/2018 05:51 PM, Eric Dumazet wrote:
> From: Eric Dumazet <edumazet@xxxxxxxxxx>
>
> A tun device type can trivially be set to arbitrary value using
> TUNSETLINK ioctl().
>
> Therefore, lowpan_device_event() must really check that ieee802154_ptr
> is not NULL.
>
> Fixes: 2c88b5283f60d ("ieee802154: 6lowpan: remove check on null")
> Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx>
> Cc: Alexander Aring <alex.aring@xxxxxxxxx>
> Cc: Stefan Schmidt <stefan@xxxxxxxxxxxxxxx>
> Reported-by: syzbot <syzkaller@xxxxxxxxxxxxxxxx>
> ---
> net/ieee802154/6lowpan/core.c | 12 ++++++++----
> 1 file changed, 8 insertions(+), 4 deletions(-)
>
> diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c
> index 974765b7d92a..e9f0489e4229 100644
> --- a/net/ieee802154/6lowpan/core.c
> +++ b/net/ieee802154/6lowpan/core.c
> @@ -206,9 +206,13 @@ static inline void lowpan_netlink_fini(void)
> static int lowpan_device_event(struct notifier_block *unused,
> unsigned long event, void *ptr)
> {
> - struct net_device *wdev = netdev_notifier_info_to_dev(ptr);
> + struct net_device *ndev = netdev_notifier_info_to_dev(ptr);
Not sure why you think there is a rename from wdev to ndev necessary.
I see this more of a rolled in cosmetic change, but its not a real problem from my side.
> + struct wpan_dev *wpan_dev;
>
> - if (wdev->type != ARPHRD_IEEE802154)
> + if (ndev->type != ARPHRD_IEEE802154)
> + return NOTIFY_DONE;
> + wpan_dev = ndev->ieee802154_ptr;
> + if (!wpan_dev)
> return NOTIFY_DONE;
>
> switch (event) {
> @@ -217,8 +221,8 @@ static int lowpan_device_event(struct notifier_block *unused,
> * also delete possible lowpan interfaces which belongs
> * to the wpan interface.
> */
> - if (wdev->ieee802154_ptr->lowpan_dev)
> - lowpan_dellink(wdev->ieee802154_ptr->lowpan_dev, NULL);
> + if (wpan_dev->lowpan_dev)
> + lowpan_dellink(wpan_dev->lowpan_dev, NULL);
> break;
> default:
> return NOTIFY_DONE;
>
Thanks a lot for fixing this and syzbot for finding it.
Acked-by: Stefan Schmidt <stefan@xxxxxxxxxxxxxxx>
Dave, could you take this one directly? I have no other patches pending for your net tree (only net-next) and having a pull request for just
this patch does not make much sense.
regards
Stefan Schmidt
--
To unsubscribe from this list: send the line "unsubscribe linux-wpan" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
