]> git.baikalelectronics.ru Git - kernel.git/commit
net: ipconfig: ic_dev can be NULL in ic_close_devs
authorVladimir Oltean <vladimir.oltean@nxp.com>
Mon, 22 Mar 2021 00:26:37 +0000 (02:26 +0200)
committerDavid S. Miller <davem@davemloft.net>
Mon, 22 Mar 2021 19:57:51 +0000 (12:57 -0700)
commit12bc1b6f878efd8f53c91a74c400cbf15febd11a
treed81a9fcf75885e0ff423382d1c03be500fe38a8c
parentce4515703d8054bccd63551c25c07cd36418bcba
net: ipconfig: ic_dev can be NULL in ic_close_devs

ic_close_dev contains a generalization of the logic to not close a
network interface if it's the host port for a DSA switch. This logic is
disguised behind an iteration through the lowers of ic_dev in
ic_close_dev.

When no interface for ipconfig can be found, ic_dev is NULL, and
ic_close_dev:
- dereferences a NULL pointer when assigning selected_dev
- would attempt to search through the lower interfaces of a NULL
  net_device pointer

So we should protect against that case.

The "lower_dev" iterator variable was shortened to "lower" in order to
keep the 80 character limit.

Fixes: 9c10fdff10e2 ("net: ipconfig: avoid use-after-free in ic_close_devs")
Fixes: 47694a2c6b5d ("Revert "net: ipv4: handle DSA enabled master network devices"")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Tested-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/ipconfig.c