linux-kernel - [PATCH] net/handshake: fix null-ptr-deref in handshake

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <tencent_ED8C80A7CB46C0D2FF064E4987AED7AEDC06@qq.com>
Date: Thu, 25 Dec 2025 08:36:02 +0800
From: Edward Adam Davis <eadavis@...com>
To: syzbot+dfffb6c26ee592ff9e83@...kaller.appspotmail.com
Cc: chuck.lever@...cle.com,
	davem@...emloft.net,
	edumazet@...gle.com,
	horms@...nel.org,
	kernel-tls-handshake@...ts.linux.dev,
	kuba@...nel.org,
	linux-kernel@...r.kernel.org,
	netdev@...r.kernel.org,
	pabeni@...hat.com,
	syzkaller-bugs@...glegroups.com
Subject: [PATCH] net/handshake: fix null-ptr-deref in handshake_complete

When retrieving the next request that has not yet completed the
three-way handshake, a null pointer is returned if the operation fails.
Patch fe67b063f687 did not consider this scenario, which triggered the
issue reported by syzbot [1].

Added handling for the case where there are no requests.

[1]
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
RIP: 0010:handshake_complete+0x36/0x350 net/handshake/request.c:288
Call Trace:
 handshake_nl_accept_doit+0x3c9/0x7f0 net/handshake/netlink.c:128
 genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115

Fixes: fe67b063f687 ("net/handshake: convert handshake_nl_accept_doit() to FD_PREPARE()")
Reported-by: syzbot+dfffb6c26ee592ff9e83@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=dfffb6c26ee592ff9e83
Signed-off-by: Edward Adam Davis <eadavis@...com>
---
 net/handshake/netlink.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/handshake/netlink.c b/net/handshake/netlink.c
index 1d33a4675a48..a36441d4372b 100644
--- a/net/handshake/netlink.c
+++ b/net/handshake/netlink.c
@@ -124,6 +124,8 @@ int handshake_nl_accept_doit(struct sk_buff *skb, struct genl_info *info)
 		fd_publish(fdf);
 		return 0;
 	}
+	else
+		goto out_status;
 
 out_complete:
 	handshake_complete(req, -EIO, NULL);
-- 
2.43.0