From 55661c87a847ed20bafa072ea6ba90e345fcfb58 Mon Sep 17 00:00:00 2001 From: Shaurya Rane Date: Sat, 29 Nov 2025 21:29:17 +0530 Subject: [PATCH net v3] net: hsr: fix NULL pointer dereference in prp_get_untagged_frame() __pskb_copy() can return NULL if memory allocation fails. When this happens in prp_get_untagged_frame(), frame->skb_std remains NULL and is passed to skb_clone(), causing a NULL pointer dereference. Add a NULL check immediately after __pskb_copy() to return early when allocation fails. BUG: KMSAN: uninit-value in skb_clone+0x1e0/0x420 net/core/skbuff.c:2129 skb_clone+0x1e0/0x420 net/core/skbuff.c:2129 prp_get_untagged_frame net/hsr/hsr_forward.c:217 [inline] hsr_forward_do+0x2fe0/0x59d0 net/hsr/hsr_forward.c:663 hsr_forward_skb+0x330/0x460 net/hsr/hsr_forward.c:720 hsr_dev_xmit+0x4a/0x80 net/hsr/hsr_device.c:199 Reported-by: syzbot+e2ca1ef26dc1c7387658@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug\?extid\=e2ca1ef26dc1c7387658 Fixes: 451d8123f897 ("net: prp: add packet handling support") Cc: stable@vger.kernel.org Signed-off-by: Shaurya Rane --- net/hsr/hsr_forward.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c index 339f0d220212..aefc9b6936ba 100644 --- a/net/hsr/hsr_forward.c +++ b/net/hsr/hsr_forward.c @@ -205,6 +205,8 @@ struct sk_buff *prp_get_untagged_frame(struct hsr_frame_info *frame, __pskb_copy(frame->skb_prp, skb_headroom(frame->skb_prp), GFP_ATOMIC); + if (!frame->skb_std) + return NULL; } else { /* Unexpected */ WARN_ONCE(1, "%s:%d: Unexpected frame received (port_src %s)\n", -- 2.34.1