Message ID | 20210621180244.882076-1-eric.dumazet@gmail.com |
---|---|
State | New |
Headers | show |
Series | [net] ieee802154: hwsim: avoid possible crash in hwsim_del_edge_nl() | expand |
Hi, On Mon, 21 Jun 2021 at 14:02, Eric Dumazet <eric.dumazet@gmail.com> wrote: > > From: Eric Dumazet <edumazet@google.com> > > Both MAC802154_HWSIM_ATTR_RADIO_ID and MAC802154_HWSIM_ATTR_RADIO_EDGE > must be present to avoid a crash. > > Fixes: f25da51fdc38 ("ieee802154: hwsim: add replacement for fakelb") > Signed-off-by: Eric Dumazet <edumazet@google.com> > Cc: Alexander Aring <alex.aring@gmail.com> > Cc: Stefan Schmidt <stefan@datenfreihafen.org> > Reported-by: syzbot <syzkaller@googlegroups.com> Acked-by: Alexander Aring <aahringo@redhat.com> Thanks! - Alex
diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c index da9135231c079d4ecc0783aa62f2fec07c3f86e6..d5e8b5a067fc6c044dac5dbe3544f4a768f78a76 100644 --- a/drivers/net/ieee802154/mac802154_hwsim.c +++ b/drivers/net/ieee802154/mac802154_hwsim.c @@ -480,7 +480,7 @@ static int hwsim_del_edge_nl(struct sk_buff *msg, struct genl_info *info) struct hwsim_edge *e; u32 v0, v1; - if (!info->attrs[MAC802154_HWSIM_ATTR_RADIO_ID] && + if (!info->attrs[MAC802154_HWSIM_ATTR_RADIO_ID] || !info->attrs[MAC802154_HWSIM_ATTR_RADIO_EDGE]) return -EINVAL;