Commit aa81700c authored Apr 06, 2020 by Davide Caratti Committed by David S. Miller Apr 06, 2020

macsec: fix NULL dereference in macsec_upd_offload()

macsec_upd_offload() gets the value of MACSEC_OFFLOAD_ATTR_TYPE
without checking its presence in the request message, and this causes
a NULL dereference. Fix it rejecting any configuration that does not
include this attribute.

Reported-and-tested-by: <syzbot+7022ab7c383875c17eff@syzkaller.appspotmail.com>
Fixes: dcb780fb ("net: macsec: add nla support for changing the offloading selection")
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent db1f00fb

drivers/net/macsec.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -2594,6 +2594,9 @@ static int macsec_upd_offload(struct sk_buff skb, struct genl_info info)
		return PTR_ERR(dev);
		macsec = macsec_priv(dev);

		if (!tb_offload[MACSEC_OFFLOAD_ATTR_TYPE])
		return -EINVAL;

		offload = nla_get_u8(tb_offload[MACSEC_OFFLOAD_ATTR_TYPE]);
		if (macsec->offload == offload)
		return 0;