ba1096c315
In nr_route_frame(), old_skb is immediately freed without checking if
nr_neigh->ax25 pointer is NULL. Therefore, if nr_neigh->ax25 is NULL,
the caller function will free old_skb again, causing a double-free bug.
Therefore, to prevent this, we need to modify it to check whether
nr_neigh->ax25 is NULL before freeing old_skb.
Cc: <stable@vger.kernel.org>
Reported-by: syzbot+999115c3bf275797dc27@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/69694d6f.050a0220.58bed.0029.GAE@google.com/
Fixes:
|
||
|---|---|---|
| .. | ||
| Makefile | ||
| af_netrom.c | ||
| nr_dev.c | ||
| nr_in.c | ||
| nr_loopback.c | ||
| nr_out.c | ||
| nr_route.c | ||
| nr_subr.c | ||
| nr_timer.c | ||
| sysctl_net_netrom.c | ||