kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/net/rose
History
Pwnverse b409ba9e1e net: rose: fix invalid array index in rose_kill_by_device() 
[ Upstream commit 6595beb40f ]

rose_kill_by_device() collects sockets into a local array[] and then
iterates over them to disconnect sockets bound to a device being brought
down.

The loop mistakenly indexes array[cnt] instead of array[i]. For cnt <
ARRAY_SIZE(array), this reads an uninitialized entry; for cnt ==
ARRAY_SIZE(array), it is an out-of-bounds read. Either case can lead to
an invalid socket pointer dereference and also leaks references taken
via sock_hold().

Fix the index to use i.

Fixes: 64b8bc7d5f ("net/rose: fix races in rose_kill_by_device()")
Co-developed-by: Fatma Alwasmi <falwasmi@purdue.edu>
Signed-off-by: Fatma Alwasmi <falwasmi@purdue.edu>
Signed-off-by: Pwnverse <stanksal@purdue.edu>
Link: https://patch.msgid.link/20251222212227.4116041-1-ritviktanksalkar@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-01-08 10:14:35 +01:00
..
af_rose.c net: rose: fix invalid array index in rose_kill_by_device() 2026-01-08 10:14:35 +01:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
rose_dev.c rose: constify dev_addr passing 2021-10-13 09:40:45 -07:00
rose_in.c net: rose: convert 'use' field to refcount_t 2025-09-04 15:31:51 +02:00
rose_link.c rose: Fix NULL pointer dereference in rose_send_frame() 2022-11-02 11:57:30 +00:00
rose_loopback.c rose: check NULL rose_loopback_neigh->loopback 2022-08-22 14:24:54 +01:00
rose_out.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
rose_route.c net: rose: fix a typo in rose_clear_routes() 2025-09-04 15:31:55 +02:00
rose_subr.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
rose_timer.c net: rose: convert 'use' field to refcount_t 2025-09-04 15:31:51 +02:00
sysctl_net_rose.c net: Remove ctl_table sentinel elements from several networking subsystems 2024-05-03 13:29:42 +01:00