]> git.baikalelectronics.ru Git - kernel.git/commit
net: ipconfig: ic_dev can be NULL in ic_close_devs
authorVladimir Oltean <vladimir.oltean@nxp.com>
Mon, 22 Mar 2021 00:26:37 +0000 (02:26 +0200)
committerDavid S. Miller <davem@davemloft.net>
Mon, 22 Mar 2021 19:57:51 +0000 (12:57 -0700)
commit065c3577e327d9968f8bb374b40d6e0cb5d7f6f3
treed81a9fcf75885e0ff423382d1c03be500fe38a8c
parentd3eabc736bca4c0df1ca6543a463b3cd60ecd6f8
net: ipconfig: ic_dev can be NULL in ic_close_devs

ic_close_dev contains a generalization of the logic to not close a
network interface if it's the host port for a DSA switch. This logic is
disguised behind an iteration through the lowers of ic_dev in
ic_close_dev.

When no interface for ipconfig can be found, ic_dev is NULL, and
ic_close_dev:
- dereferences a NULL pointer when assigning selected_dev
- would attempt to search through the lower interfaces of a NULL
  net_device pointer

So we should protect against that case.

The "lower_dev" iterator variable was shortened to "lower" in order to
keep the 80 character limit.

Fixes: dd8a95777963 ("net: ipconfig: avoid use-after-free in ic_close_devs")
Fixes: 0d1bf5cb734f ("Revert "net: ipv4: handle DSA enabled master network devices"")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Tested-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/ipconfig.c