linux/net
Eric Dumazet 41462e8f61 ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event()
[ Upstream commit ca0edb131b ]

A tun device type can trivially be set to arbitrary value using
TUNSETLINK ioctl().

Therefore, lowpan_device_event() must really check that ieee802154_ptr
is not NULL.

Fixes: 2c88b5283f ("ieee802154: 6lowpan: remove check on null")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Alexander Aring <alex.aring@gmail.com>
Cc: Stefan Schmidt <stefan@osg.samsung.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Acked-by: Stefan Schmidt <stefan@osg.samsung.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-03-31 18:12:34 +02:00
..
6lowpan
9p net/9p: Switch to wait_event_killable() 2017-11-30 08:37:25 +00:00
802
8021q net/8021q: create device with all possible features in wanted_features 2018-03-22 09:23:21 +01:00
appletalk
atm
ax25 ax25: Fix segfault after sock connection timeout 2017-02-04 09:45:09 +01:00
batman-adv batman-adv: handle race condition for claims between gateways 2018-03-22 09:23:21 +01:00
bluetooth Bluetooth: Prevent stack info leak from the EFS element. 2018-01-17 09:35:32 +01:00
bridge netfilter: bridge: ebt_among: add missing match size checks 2018-03-18 11:17:51 +01:00
caif net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx 2017-07-05 14:37:14 +02:00
can can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once 2018-01-31 12:06:08 +01:00
ceph libceph: force GFP_NOIO for socket allocations 2017-04-08 09:53:30 +02:00
core skbuff: Fix not waking applications when errors are enqueued 2018-03-31 18:12:33 +02:00
dcb
dccp dccp: check sk for closed state in dccp_sendmsg() 2018-03-31 18:12:33 +02:00
decnet dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock 2018-02-25 11:03:38 +01:00
dns_resolver KEYS: Fix race between updating and finding a negative key 2017-10-27 10:23:18 +02:00
dsa net: dsa: select NET_SWITCHDEV 2017-11-15 17:13:11 +01:00
ethernet net: introduce device min_header_len 2017-02-18 16:39:27 +01:00
hsr
ieee802154 ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event() 2018-03-31 18:12:34 +02:00
ipv4 net: Only honor ifindex in IP_PKTINFO if non-0 2018-03-31 18:12:33 +02:00
ipv6 ipv6: fix access to non-linear packet in ndisc_fill_redirect_hdr_option() 2018-03-31 18:12:33 +02:00
ipx ipx: call ipxitf_put() in ioctl error path 2017-05-25 14:30:13 +02:00
irda irda: do not leak initialized list.dev to userspace 2017-08-30 10:19:21 +02:00
iucv net/iucv: Free memory obtained by kzalloc 2018-03-31 18:12:33 +02:00
key af_key: fix buffer overread in parse_exthdrs() 2018-01-23 19:50:14 +01:00
l2tp l2tp: do not accept arbitrary sockets 2018-03-31 18:12:33 +02:00
l3mdev
lapb
llc net/llc: avoid BUG_ON() in skb_orphan() 2017-02-26 11:07:49 +01:00
mac80211 mac80211: don't parse encrypted management frames in ieee80211_frame_acked 2018-03-24 10:58:44 +01:00
mac802154
mpls mpls, nospec: Sanitize array index in mpls_label_ok() 2018-03-11 16:19:47 +01:00
netfilter netfilter: xt_CT: fix refcnt leak on error path 2018-03-24 10:58:43 +01:00
netlabel
netlink netlink: avoid a double skb free in genlmsg_mcast() 2018-03-31 18:12:33 +02:00
netrom
nfc NFC: fix device-allocation error return 2017-11-30 08:37:23 +00:00
openvswitch openvswitch: Delete conntrack entry clashing with an expectation. 2018-03-24 10:58:43 +01:00
packet net/packet: fix a race in packet_bind() and packet_notifier() 2017-12-16 10:33:56 +01:00
phonet
rds RDS: null pointer dereference in rds_atomic_free_op 2018-01-17 09:35:29 +01:00
rfkill
rose
rxrpc rxrpc: Fix several cases where a padded len isn't checked in ticket decode 2017-06-29 12:48:52 +02:00
sched sched: act_csum: don't mangle TCP and UDP GSO packets 2018-03-22 09:23:22 +01:00
sctp fixup: sctp: verify size of a new chunk in _sctp_make_chunk() 2018-03-18 11:17:54 +01:00
sunrpc SUNRPC: Allow connect to return EHOSTUNREACH 2018-02-03 17:04:28 +01:00
switchdev
tipc tipc: fix memory leak in tipc_accept_from_sock() 2017-12-16 10:33:56 +01:00
unix net/unix: don't show information about sockets from other namespaces 2017-11-18 11:11:06 +01:00
vmw_vsock vsock: use new wait API for vsock_stream_sendmsg() 2017-11-30 08:37:19 +00:00
wimax
wireless nl80211: Sanitize array index in parse_txq_params 2018-02-25 11:03:53 +01:00
x25
xfrm net: xfrm: allow clearing socket xfrm policies. 2018-03-22 09:23:28 +01:00
compat.c audit: log 32-bit socketcalls 2017-10-08 10:14:18 +02:00
Kconfig Make DST_CACHE a silent config option 2018-02-25 11:03:37 +01:00
Makefile
socket.c bpf: introduce BPF_JIT_ALWAYS_ON config 2018-02-03 17:04:24 +01:00
sysctl_net.c