mirror of
https://github.com/torvalds/linux.git
synced 2024-11-14 08:02:07 +00:00
3b3fd068c5
rose_send_frame() dereferences `neigh->dev` when called from
rose_transmit_clear_request(), and the first occurrence of the
`neigh` is in rose_loopback_timer() as `rose_loopback_neigh`,
and it is initialized in rose_add_loopback_neigh() as NULL.
i.e when `rose_loopback_neigh` used in rose_loopback_timer()
its `->dev` was still NULL and rose_loopback_timer() was calling
rose_rx_call_request() without checking for NULL.
- net/rose/rose_link.c
This bug seems to get triggered in this line:
rose_call = (ax25_address *)neigh->dev->dev_addr;
Fix it by adding NULL checking for `rose_loopback_neigh->dev`
in rose_loopback_timer().
Fixes:
|
||
|---|---|---|
| .. | ||
| af_rose.c | ||
| Makefile | ||
| rose_dev.c | ||
| rose_in.c | ||
| rose_link.c | ||
| rose_loopback.c | ||
| rose_out.c | ||
| rose_route.c | ||
| rose_subr.c | ||
| rose_timer.c | ||
| sysctl_net_rose.c | ||