diff options
| author | Eric Dumazet <edumazet@google.com> | 2025-06-20 14:28:44 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2025-06-22 19:31:14 +0100 |
| commit | b993ea46b3b601915ceaaf3c802adf11e7d6bac6 (patch) | |
| tree | 185e77ce5547f20aa42fee8c5fbeb76536c93c70 /scripts/lib/kdoc/kdoc_parser.py | |
| parent | 302251f1fdfd302ce99a619aac1a5164d0bb7c4b (diff) | |
atm: clip: prevent NULL deref in clip_push()
Blamed commit missed that vcc_destroy_socket() calls
clip_push() with a NULL skb.
If clip_devs is NULL, clip_push() then crashes when reading
skb->truesize.
Fixes: 93a2014afbac ("atm: fix a UAF in lec_arp_clear_vccs()")
Reported-by: syzbot+1316233c4c6803382a8b@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/68556f59.a00a0220.137b3.004e.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Cc: Gengming Liu <l.dmxcsnsbh@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'scripts/lib/kdoc/kdoc_parser.py')
0 files changed, 0 insertions, 0 deletions