Jeongjun Park 94d1a8bd08 netrom: fix double-free in nr_route_frame() ...

commit ba1096c315 upstream.

In nr_route_frame(), old_skb is immediately freed without checking if
nr_neigh->ax25 pointer is NULL. Therefore, if nr_neigh->ax25 is NULL,
the caller function will free old_skb again, causing a double-free bug.

Therefore, to prevent this, we need to modify it to check whether
nr_neigh->ax25 is NULL before freeing old_skb.

Cc: <stable@vger.kernel.org>
Reported-by: syzbot+999115c3bf275797dc27@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/69694d6f.050a0220.58bed.0029.GAE@google.com/
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Link: https://patch.msgid.link/20260119063359.10604-1-aha310510@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-01-30 10:28:46 +01:00

..

af_netrom.c

…

Makefile

…

nr_dev.c

…

nr_in.c

…

nr_loopback.c

…

nr_out.c

…

nr_route.c

netrom: fix double-free in nr_route_frame()

2026-01-30 10:28:46 +01:00

nr_subr.c

…

nr_timer.c

…

sysctl_net_netrom.c

…