Patch "ax25: Fix NULL pointer dereference in ax25_kill_by_device" has been added to the 4.9-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ax25: Fix NULL pointer dereference in ax25_kill_by_device

to the 4.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ax25-fix-null-pointer-dereference-in-ax25_kill_by_de.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 96d11806e461d599c42b4b757bc9b8ebe4663332
Author: Duoming Zhou <duoming@xxxxxxxxxx>
Date:   Tue Mar 8 16:12:23 2022 +0800

    ax25: Fix NULL pointer dereference in ax25_kill_by_device
    
    [ Upstream commit 71171ac8eb34ce7fe6b3267dce27c313ab3cb3ac ]
    
    When two ax25 devices attempted to establish connection, the requester use ax25_create(),
    ax25_bind() and ax25_connect() to initiate connection. The receiver use ax25_rcv() to
    accept connection and use ax25_create_cb() in ax25_rcv() to create ax25_cb, but the
    ax25_cb->sk is NULL. When the receiver is detaching, a NULL pointer dereference bug
    caused by sock_hold(sk) in ax25_kill_by_device() will happen. The corresponding
    fail log is shown below:
    
    ===============================================================
    BUG: KASAN: null-ptr-deref in ax25_device_event+0xfd/0x290
    Call Trace:
    ...
    ax25_device_event+0xfd/0x290
    raw_notifier_call_chain+0x5e/0x70
    dev_close_many+0x174/0x220
    unregister_netdevice_many+0x1f7/0xa60
    unregister_netdevice_queue+0x12f/0x170
    unregister_netdev+0x13/0x20
    mkiss_close+0xcd/0x140
    tty_ldisc_release+0xc0/0x220
    tty_release_struct+0x17/0xa0
    tty_release+0x62d/0x670
    ...
    
    This patch add condition check in ax25_kill_by_device(). If s->sk is
    NULL, it will goto if branch to kill device.
    
    Fixes: 4e0f718daf97 ("ax25: improve the incomplete fix to avoid UAF and NPD bugs")
    Reported-by: Thomas Osterried <thomas@xxxxxxxxxxxx>
    Signed-off-by: Duoming Zhou <duoming@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index c4ef1be59cb1..839c4237d131 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -90,6 +90,13 @@ static void ax25_kill_by_device(struct net_device *dev)
 	ax25_for_each(s, &ax25_list) {
 		if (s->ax25_dev == ax25_dev) {
 			sk = s->sk;
+			if (!sk) {
+				spin_unlock_bh(&ax25_list_lock);
+				s->ax25_dev = NULL;
+				ax25_disconnect(s, ENETUNREACH);
+				spin_lock_bh(&ax25_list_lock);
+				goto again;
+			}
 			sock_hold(sk);
 			spin_unlock_bh(&ax25_list_lock);
 			lock_sock(sk);