diff mbox series

[4.4,30/38] net: ieee802154: fix nl802154 add llsec key

Message ID	20210415144414.316505085@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, syzbot+ce4e062c2d51977ddc50@syzkaller.appspotmail.com, Alexander Aring <aahringo@redhat.com>, Stefan Schmidt <stefan@datenfreihafen.org> Subject: [PATCH 4.4 30/38] net: ieee802154: fix nl802154 add llsec key Date: Thu, 15 Apr 2021 16:47:24 +0200 Message-Id: <20210415144414.316505085@linuxfoundation.org> In-Reply-To: <20210415144413.352638802@linuxfoundation.org> References: <20210415144413.352638802@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [4.4,02/38] ALSA: aloop: Fix initialization of controls [4.4,03/38] nfc: fix refcount leak in llcp_sock_bind() [4.4,04/38] nfc: fix refcount leak in llcp_sock_connect() [4.4,05/38] nfc: fix memory leak in llcp_sock_connect() [4.4,06/38] nfc: Avoid endless loops caused by repeated llcp_sock_connect() [4.4,07/38] xen/evtchn: Change irq_info lock to raw_spinlock_t [4.4,08/38] net: ipv6: check for validity before dereferencing cfg->fc_nlinfo.nlh [4.4,09/38] ia64: fix user_stack_pointer() for ptrace() [4.4,10/38] fs: direct-io: fix missing sdio->boundary [4.4,11/38] parisc: parisc-agp requires SBA IOMMU driver [4.4,12/38] batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field [4.4,13/38] net: sched: sch_teql: fix null-pointer dereference [4.4,14/38] sch_red: fix off-by-one checks in red_check_params() [4.4,15/38] gianfar: Handle error code at MAC address change [4.4,16/38] net:tipc: Fix a double free in tipc_sk_mcast_rcv [4.4,17/38] clk: fix invalid usage of list cursor in unregister [4.4,18/38] workqueue: Move the position of debug_work_activate() in __queue_work() [4.4,19/38] s390/cpcmd: fix inline assembly register clobbering [4.4,20/38] RDMA/cxgb4: check for ipv6 address properly while destroying listener [4.4,21/38] clk: socfpga: fix iomem pointer cast on 64-bit [4.4,22/38] cfg80211: remove WARN_ON() in cfg80211_sme_connect [4.4,23/38] net: tun: set tun->dev->addr_len during TUNSETLINK processing [4.4,24/38] drivers: net: fix memory leak in atusb_probe [4.4,25/38] drivers: net: fix memory leak in peak_usb_create_dev [4.4,26/38] net: mac802154: Fix general protection fault [4.4,27/38] net: ieee802154: nl-mac: fix check on panid [4.4,28/38] net: ieee802154: fix nl802154 del llsec key [4.4,29/38] net: ieee802154: fix nl802154 del llsec dev [4.4,30/38] net: ieee802154: fix nl802154 add llsec key [4.4,31/38] net: ieee802154: fix nl802154 del llsec devkey [4.4,32/38] net: ieee802154: forbid monitor for set llsec params [4.4,33/38] net: ieee802154: forbid monitor for del llsec seclevel [4.4,34/38] net: ieee802154: stop dump llsec params for monitors [4.4,35/38] drm/imx: imx-ldb: fix out of bounds array access warning [4.4,36/38] netfilter: x_tables: fix compat match/target pad out-of-bound write [4.4,37/38] perf map: Tighten snprintf() string precision to pass gcc check on some 32-bit arches [4.4,38/38] xen/events: fix setting irq affinity

Commit Message

Greg Kroah-Hartman April 15, 2021, 2:47 p.m. UTC

From: Alexander Aring <aahringo@redhat.com>

commit 20d5fe2d7103f5c43ad11a3d6d259e9d61165c35 upstream.

This patch fixes a nullpointer dereference if NL802154_ATTR_SEC_KEY is
not set by the user. If this is the case nl802154 will return -EINVAL.

Reported-by: syzbot+ce4e062c2d51977ddc50@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210221174321.14210-3-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ieee802154/nl802154.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff mbox series

Patch

--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -1527,7 +1527,8 @@  static int nl802154_add_llsec_key(struct
 	struct ieee802154_llsec_key_id id = { };
 	u32 commands[NL802154_CMD_FRAME_NR_IDS / 32] = { };
 
-	if (nla_parse_nested(attrs, NL802154_KEY_ATTR_MAX,
+	if (!info->attrs[NL802154_ATTR_SEC_KEY] ||
+	    nla_parse_nested(attrs, NL802154_KEY_ATTR_MAX,
 			     info->attrs[NL802154_ATTR_SEC_KEY],
 			     nl802154_key_policy))
 		return -EINVAL;