Module Name: src
Committed By: maxv
Date: Tue Jun 23 18:30:17 UTC 2020
Modified Files:
src/sys/net: if_tun.c
Log Message:
Hum. Fix NULL deref triggerable with just write(0).
Reported-by: syzbot+45b31355bf880e175...@syzkaller.appspotmail.com
To generate a diff of this commit:
cvs rdiff -u -r1.158 -r1.159 src/sys/net/if_tun.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/net/if_tun.c
diff -u src/sys/net/if_tun.c:1.158 src/sys/net/if_tun.c:1.159
--- src/sys/net/if_tun.c:1.158 Wed Jan 29 04:34:10 2020
+++ src/sys/net/if_tun.c Tue Jun 23 18:30:17 2020
@@ -1,4 +1,4 @@
-/* $NetBSD: if_tun.c,v 1.158 2020/01/29 04:34:10 thorpej Exp $ */
+/* $NetBSD: if_tun.c,v 1.159 2020/06/23 18:30:17 maxv Exp $ */
/*
* Copyright (c) 1988, Julian Onions <j...@cs.nott.ac.uk>
@@ -19,7 +19,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_tun.c,v 1.158 2020/01/29 04:34:10 thorpej Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_tun.c,v 1.159 2020/06/23 18:30:17 maxv Exp $");
#ifdef _KERNEL_OPT
#include "opt_inet.h"
@@ -857,6 +857,9 @@ tunwrite(dev_t dev, struct uio *uio, int
TUNDEBUG("%s: tunwrite\n", ifp->if_xname);
+ if (uio->uio_resid == 0)
+ return 0;
+
if (tp->tun_flags & TUN_PREPADDR) {
if (uio->uio_resid < sizeof(dst)) {
error = EIO;
