When retrieving the next request that has not yet completed the three-way handshake, a null pointer is returned if the operation fails. Patch fe67b063f687 did not consider this scenario, which triggered the issue reported by syzbot [1]. Added handling for the case where there are no requests. [1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] RIP: 0010:handshake_complete+0x36/0x350 net/handshake/request.c:288 Call Trace: handshake_nl_accept_doit+0x3c9/0x7f0 net/handshake/netlink.c:128 genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115 Fixes: fe67b063f687 ("net/handshake: convert handshake_nl_accept_doit() to FD_PREPARE()") Reported-by: syzbot+dfffb6c26ee592ff9e83@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=dfffb6c26ee592ff9e83 Signed-off-by: Edward Adam Davis --- net/handshake/netlink.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/handshake/netlink.c b/net/handshake/netlink.c index 1d33a4675a48..a36441d4372b 100644 --- a/net/handshake/netlink.c +++ b/net/handshake/netlink.c @@ -124,6 +124,8 @@ int handshake_nl_accept_doit(struct sk_buff *skb, struct genl_info *info) fd_publish(fdf); return 0; } + else + goto out_status; out_complete: handshake_complete(req, -EIO, NULL); -- 2.43.0