Add NULL pointer checks for ser and ser->dev in ldisc_receive() to prevent memory leaks when the function is called during device close or in race conditions where tty->disc_data or ser->dev may be NULL. The memory leak occurred because netdev_alloc_skb() would allocate an skb, but if ser or ser->dev was NULL, the function would return early without freeing the allocated skb. Additionally, ser->dev was accessed before checking if it was NULL, which could cause a NULL pointer dereference. Reported-by: syzbot+f9d847b2b84164fa69f3@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f9d847b2b84164fa69f3 Fixes: 9b27105b4a44 ("net-caif-driver: add CAIF serial driver (ldisc)") CC: stable@vger.kernel.org Signed-off-by: Osama Abdelkader --- drivers/net/caif/caif_serial.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c index c398ac42eae9..0ec9670bd35c 100644 --- a/drivers/net/caif/caif_serial.c +++ b/drivers/net/caif/caif_serial.c @@ -152,12 +152,16 @@ static void ldisc_receive(struct tty_struct *tty, const u8 *data, int ret; ser = tty->disc_data; + if (!ser) + return; /* * NOTE: flags may contain information about break or overrun. * This is not yet handled. */ + if (!ser->dev) + return; /* * Workaround for garbage at start of transmission, @@ -170,8 +174,6 @@ static void ldisc_receive(struct tty_struct *tty, const u8 *data, return; } - BUG_ON(ser->dev == NULL); - /* Get a suitable caif packet and copy in data. */ skb = netdev_alloc_skb(ser->dev, count+1); if (skb == NULL) -- 2.43.0