CVE-2022-49904

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net, neigh: Fix null-ptr-deref in neigh_table_clear()<br /> <br /> When IPv6 module gets initialized but hits an error in the middle,<br /> kenel panic with:<br /> <br /> KASAN: null-ptr-deref in range [0x0000000000000598-0x000000000000059f]<br /> CPU: 1 PID: 361 Comm: insmod<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)<br /> RIP: 0010:__neigh_ifdown.isra.0+0x24b/0x370<br /> RSP: 0018:ffff888012677908 EFLAGS: 00000202<br /> ...<br /> Call Trace:<br /> <br /> neigh_table_clear+0x94/0x2d0<br /> ndisc_cleanup+0x27/0x40 [ipv6]<br /> inet6_init+0x21c/0x2cb [ipv6]<br /> do_one_initcall+0xd3/0x4d0<br /> do_init_module+0x1ae/0x670<br /> ...<br /> Kernel panic - not syncing: Fatal exception<br /> <br /> When ipv6 initialization fails, it will try to cleanup and calls:<br /> <br /> neigh_table_clear()<br /> neigh_ifdown(tbl, NULL)<br /> pneigh_queue_purge(&amp;tbl-&gt;proxy_queue, dev_net(dev == NULL))<br /> # dev_net(NULL) triggers null-ptr-deref.<br /> <br /> Fix it by passing NULL to pneigh_queue_purge() in neigh_ifdown() if dev<br /> is NULL, to make kernel not panic immediately.