* [PATCH net] ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event()
@ 2018-03-05 16:51 Eric Dumazet
2018-03-05 17:00 ` David Miller
2018-03-06 12:56 ` Stefan Schmidt
0 siblings, 2 replies; 5+ messages in thread
From: Eric Dumazet @ 2018-03-05 16:51 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Alexander Aring, Stefan Schmidt
From: Eric Dumazet <edumazet@google.com>
A tun device type can trivially be set to arbitrary value using
TUNSETLINK ioctl().
Therefore, lowpan_device_event() must really check that ieee802154_ptr
is not NULL.
Fixes: 2c88b5283f60d ("ieee802154: 6lowpan: remove check on null")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Alexander Aring <alex.aring@gmail.com>
Cc: Stefan Schmidt <stefan@osg.samsung.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
---
net/ieee802154/6lowpan/core.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c
index 974765b7d92a..e9f0489e4229 100644
--- a/net/ieee802154/6lowpan/core.c
+++ b/net/ieee802154/6lowpan/core.c
@@ -206,9 +206,13 @@ static inline void lowpan_netlink_fini(void)
static int lowpan_device_event(struct notifier_block *unused,
unsigned long event, void *ptr)
{
- struct net_device *wdev = netdev_notifier_info_to_dev(ptr);
+ struct net_device *ndev = netdev_notifier_info_to_dev(ptr);
+ struct wpan_dev *wpan_dev;
- if (wdev->type != ARPHRD_IEEE802154)
+ if (ndev->type != ARPHRD_IEEE802154)
+ return NOTIFY_DONE;
+ wpan_dev = ndev->ieee802154_ptr;
+ if (!wpan_dev)
return NOTIFY_DONE;
switch (event) {
@@ -217,8 +221,8 @@ static int lowpan_device_event(struct notifier_block *unused,
* also delete possible lowpan interfaces which belongs
* to the wpan interface.
*/
- if (wdev->ieee802154_ptr->lowpan_dev)
- lowpan_dellink(wdev->ieee802154_ptr->lowpan_dev, NULL);
+ if (wpan_dev->lowpan_dev)
+ lowpan_dellink(wpan_dev->lowpan_dev, NULL);
break;
default:
return NOTIFY_DONE;
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH net] ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event()
2018-03-05 16:51 [PATCH net] ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event() Eric Dumazet
@ 2018-03-05 17:00 ` David Miller
2018-03-06 12:56 ` Stefan Schmidt
1 sibling, 0 replies; 5+ messages in thread
From: David Miller @ 2018-03-05 17:00 UTC (permalink / raw)
To: eric.dumazet; +Cc: netdev, alex.aring, stefan, linux-wpan
From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Mon, 05 Mar 2018 08:51:03 -0800
> From: Eric Dumazet <edumazet@google.com>
>
> A tun device type can trivially be set to arbitrary value using
> TUNSETLINK ioctl().
>
> Therefore, lowpan_device_event() must really check that ieee802154_ptr
> is not NULL.
>
> Fixes: 2c88b5283f60d ("ieee802154: 6lowpan: remove check on null")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Alexander Aring <alex.aring@gmail.com>
> Cc: Stefan Schmidt <stefan@osg.samsung.com>
> Reported-by: syzbot <syzkaller@googlegroups.com>
Adding linux-wpan list.
> ---
> �net/ieee802154/6lowpan/core.c |���12 ++++++++----
> �1 file changed, 8 insertions(+), 4 deletions(-)
>
> diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c
> index 974765b7d92a..e9f0489e4229 100644
> --- a/net/ieee802154/6lowpan/core.c
> +++ b/net/ieee802154/6lowpan/core.c
> @@ -206,9 +206,13 @@ static inline void lowpan_netlink_fini(void)
> static int lowpan_device_event(struct notifier_block *unused,
> unsigned long event, void *ptr)
> {
> - struct net_device *wdev = netdev_notifier_info_to_dev(ptr);
> + struct net_device *ndev = netdev_notifier_info_to_dev(ptr);
> + struct wpan_dev *wpan_dev;
>
> - if (wdev->type != ARPHRD_IEEE802154)
> + if (ndev->type != ARPHRD_IEEE802154)
> + return NOTIFY_DONE;
> + wpan_dev = ndev->ieee802154_ptr;
> + if (!wpan_dev)
> return NOTIFY_DONE;
>
> switch (event) {
> @@ -217,8 +221,8 @@ static int lowpan_device_event(struct notifier_block *unused,
> * also delete possible lowpan interfaces which belongs
> * to the wpan interface.
> */
> - if (wdev->ieee802154_ptr->lowpan_dev)
> - lowpan_dellink(wdev->ieee802154_ptr->lowpan_dev, NULL);
> + if (wpan_dev->lowpan_dev)
> + lowpan_dellink(wpan_dev->lowpan_dev, NULL);
> break;
> default:
> return NOTIFY_DONE;
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH net] ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event()
2018-03-05 16:51 [PATCH net] ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event() Eric Dumazet
2018-03-05 17:00 ` David Miller
@ 2018-03-06 12:56 ` Stefan Schmidt
2018-03-08 16:21 ` Stefan Schmidt
1 sibling, 1 reply; 5+ messages in thread
From: Stefan Schmidt @ 2018-03-06 12:56 UTC (permalink / raw)
To: Eric Dumazet, David Miller; +Cc: netdev, Alexander Aring, linux-wpan
Hello.
On 03/05/2018 05:51 PM, Eric Dumazet wrote:
> From: Eric Dumazet <edumazet@google.com>
>
> A tun device type can trivially be set to arbitrary value using
> TUNSETLINK ioctl().
>
> Therefore, lowpan_device_event() must really check that ieee802154_ptr
> is not NULL.
>
> Fixes: 2c88b5283f60d ("ieee802154: 6lowpan: remove check on null")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Alexander Aring <alex.aring@gmail.com>
> Cc: Stefan Schmidt <stefan@osg.samsung.com>
> Reported-by: syzbot <syzkaller@googlegroups.com>
> ---
> net/ieee802154/6lowpan/core.c | 12 ++++++++----
> 1 file changed, 8 insertions(+), 4 deletions(-)
>
> diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c
> index 974765b7d92a..e9f0489e4229 100644
> --- a/net/ieee802154/6lowpan/core.c
> +++ b/net/ieee802154/6lowpan/core.c
> @@ -206,9 +206,13 @@ static inline void lowpan_netlink_fini(void)
> static int lowpan_device_event(struct notifier_block *unused,
> unsigned long event, void *ptr)
> {
> - struct net_device *wdev = netdev_notifier_info_to_dev(ptr);
> + struct net_device *ndev = netdev_notifier_info_to_dev(ptr);
Not sure why you think there is a rename from wdev to ndev necessary.
I see this more of a rolled in cosmetic change, but its not a real problem from my side.
> + struct wpan_dev *wpan_dev;
>
> - if (wdev->type != ARPHRD_IEEE802154)
> + if (ndev->type != ARPHRD_IEEE802154)
> + return NOTIFY_DONE;
> + wpan_dev = ndev->ieee802154_ptr;
> + if (!wpan_dev)
> return NOTIFY_DONE;
>
> switch (event) {
> @@ -217,8 +221,8 @@ static int lowpan_device_event(struct notifier_block *unused,
> * also delete possible lowpan interfaces which belongs
> * to the wpan interface.
> */
> - if (wdev->ieee802154_ptr->lowpan_dev)
> - lowpan_dellink(wdev->ieee802154_ptr->lowpan_dev, NULL);
> + if (wpan_dev->lowpan_dev)
> + lowpan_dellink(wpan_dev->lowpan_dev, NULL);
> break;
> default:
> return NOTIFY_DONE;
>
Thanks a lot for fixing this and syzbot for finding it.
Acked-by: Stefan Schmidt <stefan@osg.samsung.com>
Dave, could you take this one directly? I have no other patches pending for your net tree (only net-next) and having a pull request for just
this patch does not make much sense.
regards
Stefan Schmidt
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH net] ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event()
2018-03-06 12:56 ` Stefan Schmidt
@ 2018-03-08 16:21 ` Stefan Schmidt
2018-03-09 16:19 ` David Miller
0 siblings, 1 reply; 5+ messages in thread
From: Stefan Schmidt @ 2018-03-08 16:21 UTC (permalink / raw)
To: Eric Dumazet, David Miller; +Cc: netdev, Alexander Aring, linux-wpan
Hello Dave.
On 03/06/2018 01:56 PM, Stefan Schmidt wrote:
> Hello.
>
>
> On 03/05/2018 05:51 PM, Eric Dumazet wrote:
>> From: Eric Dumazet <edumazet@google.com>
>>
>> A tun device type can trivially be set to arbitrary value using
>> TUNSETLINK ioctl().
>>
>> Therefore, lowpan_device_event() must really check that ieee802154_ptr
>> is not NULL.
>>
>> Fixes: 2c88b5283f60d ("ieee802154: 6lowpan: remove check on null")
>> Signed-off-by: Eric Dumazet <edumazet@google.com>
>> Cc: Alexander Aring <alex.aring@gmail.com>
>> Cc: Stefan Schmidt <stefan@osg.samsung.com>
>> Reported-by: syzbot <syzkaller@googlegroups.com>
>> ---
>> net/ieee802154/6lowpan/core.c | 12 ++++++++----
>> 1 file changed, 8 insertions(+), 4 deletions(-)
>>
>> diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c
>> index 974765b7d92a..e9f0489e4229 100644
>> --- a/net/ieee802154/6lowpan/core.c
>> +++ b/net/ieee802154/6lowpan/core.c
>> @@ -206,9 +206,13 @@ static inline void lowpan_netlink_fini(void)
>> static int lowpan_device_event(struct notifier_block *unused,
>> unsigned long event, void *ptr)
>> {
>> - struct net_device *wdev = netdev_notifier_info_to_dev(ptr);
>> + struct net_device *ndev = netdev_notifier_info_to_dev(ptr);
> Not sure why you think there is a rename from wdev to ndev necessary.
> I see this more of a rolled in cosmetic change, but its not a real problem from my side.
>
>> + struct wpan_dev *wpan_dev;
>>
>> - if (wdev->type != ARPHRD_IEEE802154)
>> + if (ndev->type != ARPHRD_IEEE802154)
>> + return NOTIFY_DONE;
>> + wpan_dev = ndev->ieee802154_ptr;
>> + if (!wpan_dev)
>> return NOTIFY_DONE;
>>
>> switch (event) {
>> @@ -217,8 +221,8 @@ static int lowpan_device_event(struct notifier_block *unused,
>> * also delete possible lowpan interfaces which belongs
>> * to the wpan interface.
>> */
>> - if (wdev->ieee802154_ptr->lowpan_dev)
>> - lowpan_dellink(wdev->ieee802154_ptr->lowpan_dev, NULL);
>> + if (wpan_dev->lowpan_dev)
>> + lowpan_dellink(wpan_dev->lowpan_dev, NULL);
>> break;
>> default:
>> return NOTIFY_DONE;
>>
> Thanks a lot for fixing this and syzbot for finding it.
>
>
> Acked-by: Stefan Schmidt <stefan@osg.samsung.com>
>
> Dave, could you take this one directly? I have no other patches pending for your net tree (only net-next) and having a pull request for just
> this patch does not make much sense.
>
Did you miss this or would you prefer if I do a pull request for this single patch?
Either way would be fine with me.
regards
Stefan Schmidt
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2018-03-09 16:19 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-03-05 16:51 [PATCH net] ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event() Eric Dumazet
2018-03-05 17:00 ` David Miller
2018-03-06 12:56 ` Stefan Schmidt
2018-03-08 16:21 ` Stefan Schmidt
2018-03-09 16:19 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).