diff options
| author | Bernard Pidoux <bernard.f6bvp@gmail.com> | 2026-05-16 12:10:55 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-06-27 11:07:39 +0100 |
| commit | 97f849566cc55472a5acd6c669c70a37ef6fd47e (patch) | |
| tree | 3a4512bc6cb52cd2d4578374210e01aaae639459 | |
| parent | ccf200f62de0cd5697220132effa46f8166a6a2b (diff) | |
| download | linux-stable-97f849566cc55472a5acd6c669c70a37ef6fd47e.tar.gz linux-stable-97f849566cc55472a5acd6c669c70a37ef6fd47e.zip | |
rose: guard rose_neigh_put() against NULL in timer expiry
commit 2b67342c6ff899a0b83359517146a5b7b243af97 upstream.
In rose_timer_expiry(), the ROSE_STATE_2 branch calls
rose_neigh_put(rose->neighbour) without first checking whether the
pointer is NULL. After commit 5de7665e0a07 ("net: rose: fix timer
races against user threads") the timer is re-armed when the socket is
owned by a user thread; between the re-arm and the next firing, a
device-down event or concurrent teardown via rose_kill_by_device() can
set rose->neighbour to NULL, leading to a NULL-pointer dereference
inside rose_neigh_put().
Add a NULL check before the put and clear the pointer afterwards.
Fixes: 5de7665e0a07 ("net: rose: fix timer races against user threads")
Signed-off-by: Bernard Pidoux <bernard.f6bvp@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | net/rose/rose_timer.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/net/rose/rose_timer.c b/net/rose/rose_timer.c index bb60a1654d61..d997d24ab081 100644 --- a/net/rose/rose_timer.c +++ b/net/rose/rose_timer.c @@ -180,7 +180,10 @@ static void rose_timer_expiry(struct timer_list *t) break; case ROSE_STATE_2: /* T3 */ - rose_neigh_put(rose->neighbour); + if (rose->neighbour) { + rose_neigh_put(rose->neighbour); + rose->neighbour = NULL; + } rose_disconnect(sk, ETIMEDOUT, -1, -1); break; |