71171ac8eb
When two ax25 devices attempted to establish connection, the requester use ax25_create(),
ax25_bind() and ax25_connect() to initiate connection. The receiver use ax25_rcv() to
accept connection and use ax25_create_cb() in ax25_rcv() to create ax25_cb, but the
ax25_cb->sk is NULL. When the receiver is detaching, a NULL pointer dereference bug
caused by sock_hold(sk) in ax25_kill_by_device() will happen. The corresponding
fail log is shown below:
===============================================================
BUG: KASAN: null-ptr-deref in ax25_device_event+0xfd/0x290
Call Trace:
...
ax25_device_event+0xfd/0x290
raw_notifier_call_chain+0x5e/0x70
dev_close_many+0x174/0x220
unregister_netdevice_many+0x1f7/0xa60
unregister_netdevice_queue+0x12f/0x170
unregister_netdev+0x13/0x20
mkiss_close+0xcd/0x140
tty_ldisc_release+0xc0/0x220
tty_release_struct+0x17/0xa0
tty_release+0x62d/0x670
...
This patch add condition check in ax25_kill_by_device(). If s->sk is
NULL, it will goto if branch to kill device.
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| af_ax25.c | ||
| ax25_addr.c | ||
| ax25_dev.c | ||
| ax25_ds_in.c | ||
| ax25_ds_subr.c | ||
| ax25_ds_timer.c | ||
| ax25_iface.c | ||
| ax25_in.c | ||
| ax25_ip.c | ||
| ax25_out.c | ||
| ax25_route.c | ||
| ax25_std_in.c | ||
| ax25_std_subr.c | ||
| ax25_std_timer.c | ||
| ax25_subr.c | ||
| ax25_timer.c | ||
| ax25_uid.c | ||
| sysctl_net_ax25.c | ||