kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/net/irda
History
Vegard Nossum 29d011ab2d net/irda: fix NULL pointer dereference on memory allocation failure 
[ Upstream commit d3e6952cfb ]

I ran into this:

    kasan: CONFIG_KASAN_INLINE enabled
    kasan: GPF could be caused by NULL-ptr deref or user memory access
    general protection fault: 0000 [#1] PREEMPT SMP KASAN
    CPU: 2 PID: 2012 Comm: trinity-c3 Not tainted 4.7.0-rc7+ #19
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
    task: ffff8800b745f2c0 ti: ffff880111740000 task.ti: ffff880111740000
    RIP: 0010:[<ffffffff82bbf066>]  [<ffffffff82bbf066>] irttp_connect_request+0x36/0x710
    RSP: 0018:ffff880111747bb8  EFLAGS: 00010286
    RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000069dd8358
    RDX: 0000000000000009 RSI: 0000000000000027 RDI: 0000000000000048
    RBP: ffff880111747c00 R08: 0000000000000000 R09: 0000000000000000
    R10: 0000000069dd8358 R11: 1ffffffff0759723 R12: 0000000000000000
    R13: ffff88011a7e4780 R14: 0000000000000027 R15: 0000000000000000
    FS:  00007fc738404700(0000) GS:ffff88011af00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007fc737fdfb10 CR3: 0000000118087000 CR4: 00000000000006e0
    Stack:
     0000000000000200 ffff880111747bd8 ffffffff810ee611 ffff880119f1f220
     ffff880119f1f4f8 ffff880119f1f4f0 ffff88011a7e4780 ffff880119f1f232
     ffff880119f1f220 ffff880111747d58 ffffffff82bca542 0000000000000000
    Call Trace:
     [<ffffffff82bca542>] irda_connect+0x562/0x1190
     [<ffffffff825ae582>] SYSC_connect+0x202/0x2a0
     [<ffffffff825b4489>] SyS_connect+0x9/0x10
     [<ffffffff8100334c>] do_syscall_64+0x19c/0x410
     [<ffffffff83295ca5>] entry_SYSCALL64_slow_path+0x25/0x25
    Code: 41 89 ca 48 89 e5 41 57 41 56 41 55 41 54 41 89 d7 53 48 89 fb 48 83 c7 48 48 89 fa 41 89 f6 48 c1 ea 03 48 83 ec 20 4c 8b 65 10 <0f> b6 04 02 84 c0 74 08 84 c0 0f 8e 4c 04 00 00 80 7b 48 00 74
    RIP  [<ffffffff82bbf066>] irttp_connect_request+0x36/0x710
     RSP <ffff880111747bb8>
    ---[ end trace 4cda2588bc055b30 ]---

The problem is that irda_open_tsap() can fail and leave self->tsap = NULL,
and then irttp_connect_request() almost immediately dereferences it.

Cc: stable@vger.kernel.org
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
History 2016-08-22 12:23:18 -04:00
..
ircomm net: irda: fix wait_until_sent poll timeout 2015-03-14 15:37:25 -04:00
irlan irda: add __init to irlan_open 2014-09-30 17:08:06 -04:00
irnet net: misc: Remove extern from function prototypes 2013-10-19 19:12:11 -04:00
af_irda.c net/irda: fix NULL pointer dereference on memory allocation failure 2016-08-22 12:23:18 -04:00
discovery.c net/irda: Fix FSF address in file headers 2013-12-06 12:37:57 -05:00
irda_device.c net: set name_assign_type in alloc_netdev() 2014-07-15 16:12:48 -07:00
iriap.c irda: small read past the end of array in debug code 2013-04-19 17:32:31 -04:00
iriap_event.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
irias_object.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
irlap.c net/irda: Fix FSF address in file headers 2013-12-06 12:37:57 -05:00
irlap_event.c irda: irlap_event: Fix set-but-unused variables. 2011-04-17 16:59:09 -07:00
irlap_frame.c irda: Fix rd_frame control field initialization in irlap_send_rd_frame() 2014-08-13 20:05:52 -07:00
irlmp.c irda: precedence bug in irlmp_seq_hb_idx() 2015-12-03 10:11:07 -05:00
irlmp_event.c Fix common misspellings 2011-03-31 11:26:23 -03:00
irlmp_frame.c net: return operator cleanup 2010-09-23 14:33:39 -07:00
irmod.c net: convert usage of packet_type to read_mostly 2009-03-10 05:22:43 -07:00
irnetlink.c genetlink: only pass array to genl_register_family_with_ops() 2013-11-19 16:39:05 -05:00
irproc.c irda: irproc: Fix set-but-unused variables. 2011-04-17 16:59:50 -07:00
irqueue.c net: Remove casts to same type 2012-06-04 11:45:11 -04:00
irsysctl.c net: Convert uses of typedef ctl_table to struct ctl_table 2013-06-13 02:36:09 -07:00
irttp.c net/irda: fixed style issues in irttp 2013-07-19 17:34:40 -07:00
Kconfig [S390] Kconfig: unwanted menus for s390. 2007-05-10 15:46:07 +02:00
Makefile [IrDA]: Netlink layer. 2007-07-10 22:16:43 -07:00
parameters.c net/irda: Fix FSF address in file headers 2013-12-06 12:37:57 -05:00
qos.c net/irda: Fix FSF address in file headers 2013-12-06 12:37:57 -05:00
timer.c treewide: Replace incomming with incoming in all comments and strings 2013-01-03 16:15:49 +01:00
wrapper.c net: replace remaining __FUNCTION__ occurrences 2008-03-05 20:47:47 -08:00