kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/net/netrom
History
Jeongjun Park 6e0110ea90 netrom: fix double-free in nr_route_frame() 
commit ba1096c315 upstream.

In nr_route_frame(), old_skb is immediately freed without checking if
nr_neigh->ax25 pointer is NULL. Therefore, if nr_neigh->ax25 is NULL,
the caller function will free old_skb again, causing a double-free bug.

Therefore, to prevent this, we need to modify it to check whether
nr_neigh->ax25 is NULL before freeing old_skb.

Cc: <stable@vger.kernel.org>
Reported-by: syzbot+999115c3bf275797dc27@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/69694d6f.050a0220.58bed.0029.GAE@google.com/
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Link: https://patch.msgid.link/20260119063359.10604-1-aha310510@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-02-06 16:41:58 +01:00
..
af_netrom.c netrom: Fix data-races around sysctl_net_busy_read 2024-03-15 10:48:17 -04:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
nr_dev.c netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser 2024-03-15 10:48:16 -04:00
nr_in.c netrom: Fix data-races around sysctl_net_busy_read 2024-03-15 10:48:17 -04:00
nr_loopback.c net: Remove redundant if statements 2021-08-05 13:27:50 +01:00
nr_out.c netrom: Fix memory leak in nr_sendmsg() 2026-01-19 13:09:43 +01:00
nr_route.c netrom: fix double-free in nr_route_frame() 2026-02-06 16:41:58 +01:00
nr_subr.c netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser 2024-03-15 10:48:16 -04:00
nr_timer.c netrom: Fix a memory leak in nr_heartbeat_expiry() 2024-07-05 09:14:29 +02:00
sysctl_net_netrom.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00