Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1533526

[PATCH 1/1] ax25: Fix segfault when receiving an iframe with net2kiss loaded

Show all headers | View raw

AX.25 uses sock_queue_rcv_skb() to queue an iframe received packet.
This routine writes NULL to the socket buffer device structure
pointer. The socket buffer is subsequently serviced by
__netif_receiv_skb_core() which dereferences the device structure
pointer & segfaults.

The fix puts the ax25 device structure pointer back in the socket
buffer struct after sock_queue_rcv_skb() is called.

To trigger the segfault setup an ax.25 device (ax0) then run net2kiss
(net2kiss -v -i ax0 /dev/ptmx). In another console make an ax.25
connection (call udr0 jnbbs). Within 2 received packets a segfault
will occur.

Please submit to -stable.

Signed-off-by: Basil Gunn <basil@pacabunga.com>
---
 net/ax25/ax25_in.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/ax25/ax25_in.c b/net/ax25/ax25_in.c
index bb5a0e4..417f21a 100644
--- a/net/ax25/ax25_in.c
+++ b/net/ax25/ax25_in.c
@@ -144,10 +144,15 @@ int ax25_rx_iframe(ax25_cb *ax25, struct sk_buff *skb)
        if (ax25->sk != NULL && ax25->ax25_dev->values[AX25_VALUES_CONMODE] == 2) {
                if ((!ax25->pidincl && ax25->sk->sk_protocol == pid) ||
                    ax25->pidincl) {
+                       /* Will set socket buffer device struct pointer,
+                        *  skb->dev to NULL
+                        */
                        if (sock_queue_rcv_skb(ax25->sk, skb) == 0)
                                queued = 1;
                        else
                                ax25->condition |= AX25_COND_OWN_RX_BUSY;
+
+                       skb->dev = ax25->ax25_dev->dev;
                }
        }

--
2.1.4

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH 1/1] ax25: Fix segfault when receiving an iframe with  net2kiss loaded Basil Gunn <basil@pacabunga.com> - 2016-11-30 20:30 +0100
  Re: [PATCH 1/1] ax25: Fix segfault when receiving an iframe with  net2kiss loaded David Miller <davem@redhat.com> - 2016-12-02 17:20 +0100

csiph-web