kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/net/rose
History
Pwnverse ed2639414d net: rose: fix invalid array index in rose_kill_by_device() 
[ Upstream commit 6595beb40f ]

rose_kill_by_device() collects sockets into a local array[] and then
iterates over them to disconnect sockets bound to a device being brought
down.

The loop mistakenly indexes array[cnt] instead of array[i]. For cnt <
ARRAY_SIZE(array), this reads an uninitialized entry; for cnt ==
ARRAY_SIZE(array), it is an out-of-bounds read. Either case can lead to
an invalid socket pointer dereference and also leaks references taken
via sock_hold().

Fix the index to use i.

Fixes: 64b8bc7d5f ("net/rose: fix races in rose_kill_by_device()")
Co-developed-by: Fatma Alwasmi <falwasmi@purdue.edu>
Signed-off-by: Fatma Alwasmi <falwasmi@purdue.edu>
Signed-off-by: Pwnverse <stanksal@purdue.edu>
Link: https://patch.msgid.link/20251222212227.4116041-1-ritviktanksalkar@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-01-19 13:09:58 +01:00
..
af_rose.c net: rose: fix invalid array index in rose_kill_by_device() 2026-01-19 13:09:58 +01:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
rose_dev.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
rose_in.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
rose_link.c rose: Fix NULL pointer dereference in rose_send_frame() 2022-11-10 18:15:29 +01:00
rose_loopback.c rose: check NULL rose_loopback_neigh->loopback 2022-08-31 17:16:38 +02:00
rose_out.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
rose_route.c rose: fix dangling neighbour pointers in rose_rt_device_down() 2025-07-10 15:57:46 +02:00
rose_subr.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
rose_timer.c net: rose: fix timer races against user threads 2025-03-13 12:50:12 +01:00
sysctl_net_rose.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00