Message ID | 20191205072339.21906-1-ap420073@gmail.com |
---|---|
State | Accepted |
Delegated to: | David Miller |
Headers | show |
Series | [v2,net] hsr: fix a NULL pointer dereference in hsr_dev_xmit() | expand |
From: Taehee Yoo <ap420073@gmail.com> Date: Thu, 5 Dec 2019 07:23:39 +0000 > hsr_dev_xmit() calls hsr_port_get_hsr() to find master node and that would > return NULL if master node is not existing in the list. > But hsr_dev_xmit() doesn't check return pointer so a NULL dereference > could occur. > > Test commands: ... > Splat looks like: ... > Fixes: 311633b60406 ("hsr: switch ->dellink() to ->ndo_uninit()") > Acked-by: Cong Wang <xiyou.wangcong@gmail.com> > Signed-off-by: Taehee Yoo <ap420073@gmail.com> Applied and queued up for v5.3 -stable, thanks.
diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c index f509b495451a..b01e1bae4ddc 100644 --- a/net/hsr/hsr_device.c +++ b/net/hsr/hsr_device.c @@ -227,8 +227,13 @@ static int hsr_dev_xmit(struct sk_buff *skb, struct net_device *dev) struct hsr_port *master; master = hsr_port_get_hsr(hsr, HSR_PT_MASTER); - skb->dev = master->dev; - hsr_forward_skb(skb, master); + if (master) { + skb->dev = master->dev; + hsr_forward_skb(skb, master); + } else { + atomic_long_inc(&dev->tx_dropped); + dev_kfree_skb_any(skb); + } return NETDEV_TX_OK; }