From: Cong Wang <xiyou.wangc...@gmail.com> Date: Sat, 29 Dec 2018 13:56:36 -0800
> There are multiple issues here: > > 1. After freeing dev->ax25_ptr, we need to set it to NULL otherwise > we may use a dangling pointer. > > 2. There is a race between ax25_setsockopt() and device notifier as > reported by syzbot. Close it by holding RTNL lock. > > 3. We need to test if dev->ax25_ptr is NULL before using it. > > Reported-and-tested-by: syzbot+ae6bb869cbed29b29...@syzkaller.appspotmail.com > Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com> Applied and queued up for -stable, thanks Cong.
