]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
net: appletalk: fix NULL pointer dereference in aarp_send_ddp()
authorWeiming Shi <bestswngs@gmail.com>
Thu, 14 May 2026 12:38:08 +0000 (05:38 -0700)
committerJakub Kicinski <kuba@kernel.org>
Mon, 18 May 2026 23:33:34 +0000 (16:33 -0700)
commit9e7f36ab5b7bf68463faa5f7b926fea8f35597bb
tree121c07e1f583ed3aa786e7047e59ef5654bb29ab
parentc326f9c68921e2f14dfcecb2f6b4216313d50248
net: appletalk: fix NULL pointer dereference in aarp_send_ddp()

aarp_send_ddp() calls atalk_find_dev_addr(dev) in the LocalTalk fast
path without checking for NULL. When the device has no AppleTalk
interface configured (dev->atalk_ptr == NULL), this leads to a NULL
pointer dereference at the at->s_net access.

 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
 RIP: 0010:aarp_send_ddp (net/appletalk/aarp.c:552 (discriminator 2))
 Call Trace:
  <TASK>
  atalk_sendmsg (net/appletalk/ddp.c:1715)
  __sys_sendto (net/socket.c:2265 (discriminator 1))
  __x64_sys_sendto (net/socket.c:2272)
  do_syscall_64 (arch/x86/entry/syscall_64.c:94)
  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

Add a NULL check consistent with the other callers of
atalk_find_dev_addr().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Link: https://patch.msgid.link/20260514123806.3085961-3-bestswngs@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/appletalk/aarp.c