diff mbox series

[5.4,105/111] net: ieee802154: fix nl802154 del llsec dev

Message ID	20210412084007.767982487@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, syzbot+d946223c2e751d136c94@syzkaller.appspotmail.com, Alexander Aring <aahringo@redhat.com>, Stefan Schmidt <stefan@datenfreihafen.org> Subject: [PATCH 5.4 105/111] net: ieee802154: fix nl802154 del llsec dev Date: Mon, 12 Apr 2021 10:41:23 +0200 Message-Id: <20210412084007.767982487@linuxfoundation.org> In-Reply-To: <20210412084004.200986670@linuxfoundation.org> References: <20210412084004.200986670@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.4,002/111] ALSA: aloop: Fix initialization of controls [5.4,004/111] ASoC: intel: atom: Stop advertising non working S24LE support [5.4,006/111] nfc: fix refcount leak in llcp_sock_connect() [5.4,008/111] nfc: Avoid endless loops caused by repeated llcp_sock_connect() [5.4,009/111] xen/evtchn: Change irq_info lock to raw_spinlock_t [5.4,011/111] net: dsa: lantiq_gswip: Let GSWIP automatically set the xMII clock [5.4,013/111] gcov: re-fix clang-11+ support [5.4,017/111] fs: direct-io: fix missing sdio->boundary [5.4,022/111] ice: Increase control queue timeout [5.4,023/111] ice: Fix for dereference of NULL pointer [5.4,025/111] net: hso: fix null-ptr-deref during tty device unregistration [5.4,027/111] bpf, sockmap: Fix sk->prot unhash op reset [5.4,029/111] i40e: Fix sparse warning: missing error code err [5.4,032/111] mac80211: fix TXQ AC confusion [5.4,034/111] net-ipv6: bugfix - raw & sctp - switch to ipv6_can_nonlocal_bind() [5.4,037/111] usbip: stub-dev synchronize sysfs code paths [5.4,038/111] usbip: vudc synchronize sysfs code paths [5.4,040/111] i2c: turn recovery error on init to debug [5.4,041/111] virtio_net: Add XDP meta data support [5.4,043/111] net: dsa: lantiq_gswip: Dont use PHY auto polling [5.4,045/111] xfrm: interface: fix ipv4 pmtu check to honor ip header df [5.4,047/111] net: xfrm: Localize sequence counter per network namespace [5.4,048/111] esp: delete NETIF_F_SCTP_CRC bit from features for esp offload [5.4,050/111] ASoC: SOF: Intel: HDA: fix core status verification [5.4,051/111] ASoC: wm8960: Fix wrong bclk and lrclk with pll enabled for some chips [5.4,054/111] i40e: Fix kernel oops when i40e driver removes VFs [5.4,057/111] amd-xgbe: Update DMA coherency values [5.4,058/111] sch_red: fix off-by-one checks in red_check_params() [5.4,060/111] can: bcm/raw: fix msg_namelen values depending on CAN_REQUIRED_SIZE [5.4,062/111] cxgb4: avoid collecting SGE_QBASE regs during traffic [5.4,063/111] net:tipc: Fix a double free in tipc_sk_mcast_rcv [5.4,065/111] net/ncsi: Avoid channel_monitor hrtimer deadlock [5.4,066/111] nfp: flower: ignore duplicate merge hints from FW [5.4,068/111] ASoC: sunxi: sun4i-codec: fill ASoC card owner [5.4,069/111] net/mlx5e: Fix ethtool indication of connector type [5.4,071/111] net/rds: Fix a use after free in rds_message_map_pages [5.4,072/111] soc/fsl: qbman: fix conflicting alignment attributes [5.4,073/111] i40e: Fix display statistics for veb_tc [5.4,075/111] net: udp: Add support for getsockopt(..., ..., UDP_GRO, ..., ...); [5.4,076/111] scsi: ufs: Fix irq return code [5.4,078/111] scsi: ufs: Use blk_{get,put}_request() to allocate and free TMFs [5.4,081/111] net: macb: restore cmp registers on resume path [5.4,082/111] clk: fix invalid usage of list cursor in register [5.4,083/111] clk: fix invalid usage of list cursor in unregister [5.4,086/111] perf inject: Fix repipe usage [5.4,089/111] net: hns3: clear VF down state bit before request link status [5.4,092/111] RDMA/cxgb4: check for ipv6 address properly while destroying listener [5.4,094/111] RAS/CEC: Correct ce_add_elem()s returned values [5.4,095/111] clk: socfpga: fix iomem pointer cast on 64-bit [5.4,098/111] cfg80211: remove WARN_ON() in cfg80211_sme_connect [5.4,099/111] net: tun: set tun->dev->addr_len during TUNSETLINK processing [5.4,101/111] drivers: net: fix memory leak in peak_usb_create_dev [5.4,102/111] net: mac802154: Fix general protection fault [5.4,105/111] net: ieee802154: fix nl802154 del llsec dev [5.4,109/111] net: ieee802154: forbid monitor for del llsec seclevel [5.4,110/111] net: ieee802154: stop dump llsec params for monitors [5.4,111/111] Revert "cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting cifs_sb->prepath."

Commit Message

Greg Kroah-Hartman April 12, 2021, 8:41 a.m. UTC

From: Alexander Aring <aahringo@redhat.com>

commit 3d1eac2f45585690d942cf47fd7fbd04093ebd1b upstream.

This patch fixes a nullpointer dereference if NL802154_ATTR_SEC_DEVICE is
not set by the user. If this is the case nl802154 will return -EINVAL.

Reported-by: syzbot+d946223c2e751d136c94@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210221174321.14210-2-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ieee802154/nl802154.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff mbox series

Patch

--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -1774,7 +1774,8 @@  static int nl802154_del_llsec_dev(struct
 	struct nlattr *attrs[NL802154_DEV_ATTR_MAX + 1];
 	__le64 extended_addr;
 
-	if (nla_parse_nested_deprecated(attrs, NL802154_DEV_ATTR_MAX, info->attrs[NL802154_ATTR_SEC_DEVICE], nl802154_dev_policy, info->extack))
+	if (!info->attrs[NL802154_ATTR_SEC_DEVICE] ||
+	    nla_parse_nested_deprecated(attrs, NL802154_DEV_ATTR_MAX, info->attrs[NL802154_ATTR_SEC_DEVICE], nl802154_dev_policy, info->extack))
 		return -EINVAL;
 
 	if (!attrs[NL802154_DEV_ATTR_EXTENDED_ADDR])