When retrieving the next request that has not yet completed the
three-way handshake, a null pointer is returned if the operation fails.
Patch fe67b063f687 did not consider this scenario, which triggered the
issue reported by syzbot [1].
Added handling for the case where there are no requests.
[1]
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
RIP: 0010:handshake_complete+0x36/0x350 net/handshake/request.c:288
Call Trace:
handshake_nl_accept_doit+0x3c9/0x7f0 net/handshake/netlink.c:128
genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115
Fixes: fe67b063f687 ("net/handshake: convert handshake_nl_accept_doit() to FD_PREPARE()")
Reported-by: syzbot+dfffb6c26ee592ff9e83@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=dfffb6c26ee592ff9e83
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
net/handshake/netlink.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/handshake/netlink.c b/net/handshake/netlink.c
index 1d33a4675a48..a36441d4372b 100644
--- a/net/handshake/netlink.c
+++ b/net/handshake/netlink.c
@@ -124,6 +124,8 @@ int handshake_nl_accept_doit(struct sk_buff *skb, struct genl_info *info)
fd_publish(fdf);
return 0;
}
+ else
+ goto out_status;
out_complete:
handshake_complete(req, -EIO, NULL);
--
2.43.0