• vegard.nossum@oracle.com's avatar
    ieee802154: check device type · 5b3211dc
    vegard.nossum@oracle.com authored
    I've observed a NULL pointer dereference in ieee802154_del_iface() during
    netlink fuzzing. It's the ->wpan_phy dereference here:
    
            phy = dev->ieee802154_ptr->wpan_phy;
    
    My bet is that we're not checking that this is an IEEE802154 interface,
    so let's do what ieee802154_nl_get_dev() is doing. (Maybe we should even
    be calling this directly?)
    
    Cc: Lennert Buytenhek <buytenh@wantstofly.org>
    Cc: Alexander Aring <alex.aring@gmail.com>
    Cc: Marcel Holtmann <marcel@holtmann.org>
    Cc: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
    Cc: Sergey Lapin <slapin@ossfans.org>
    Signed-off-by: default avatarVegard Nossum <vegard.nossum@oracle.com>
    Acked-by: default avatarAlexander Aring <aar@pengutronix.de>
    Signed-off-by: default avatarStefan Schmidt <stefan@osg.samsung.com>
    5b3211dc
nl-phy.c 7.95 KB