From 1ba4a55794c95f5d843e9eaa727d1c8f308098cf Mon Sep 17 00:00:00 2001 From: Bernard Pidoux Date: Mon, 7 Sep 2026 14:39:32 +0200 Subject: [PATCH] rose: guard rose_transmit_link() against a NULL neighbour rose_kick() and rose_write_internal() call rose_transmit_link(skb, rose->neighbour) without checking that rose->neighbour is still set. Since commit e8eb0c6faa88 ("rose: clear neighbour pointer after rose_neigh_put() in state machines"), the state machines routinely set rose->neighbour to NULL once the underlying AX.25 link is gone, while leaving the socket in ROSE_STATE_3. rose_kick() only checks the state, not the neighbour, so a write() on such a socket reaches rose_transmit_link() with neigh == NULL, which immediately dereferences neigh->loopback and crashes: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000036 ... pc : rose_transmit_link+0x14/0x1c8 [rose] lr : rose_kick+0xec/0x198 [rose] Call trace: rose_transmit_link+0x14/0x1c8 [rose] (P) rose_kick+0xec/0x198 [rose] rose_sendmsg+0x260/0x3c8 [rose] Reproduced on f6bvp-8 (a real ROSE/FPAC node) when the BBS daemon wrote to a socket whose neighbour had just been cleared. Confirmed by recompiling rose_link.o with a static_assert on offsetof(struct rose_neigh, loopback), which matches the faulting address (0x36) exactly. Drop the skb and return early when neigh is NULL, matching what rose_transmit_link() already does for other frames it cannot send. Fixes: e8eb0c6faa88 ("rose: clear neighbour pointer after rose_neigh_put() in state machines") Signed-off-by: Bernard Pidoux --- net/rose/rose_link.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/rose/rose_link.c b/net/rose/rose_link.c index 7746229..36b6778 100644 --- a/net/rose/rose_link.c +++ b/net/rose/rose_link.c @@ -263,6 +263,11 @@ void rose_transmit_link(struct sk_buff *skb, struct rose_neigh *neigh) { unsigned char *dptr; + if (!neigh) { + kfree_skb(skb); + return; + } + if (neigh->loopback) { rose_loopback_queue(skb, neigh); return;