{"api_version":"1","generated_at":"2026-10-11T09:29:35+00:00","cve":"CVE-2026-98302","urls":{"html":"https://cve.report/CVE-2026-98302","api":"https://cve.report/api/cve/CVE-2026-98302.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98302","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98302"},"summary":{"title":"net: fddi: skfp: fix NULL deref when setting the MAC address while down","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fddi: skfp: fix NULL deref when setting the MAC address while down\n\nskfp_ctl_set_mac_address() calls ResetAdapter() unconditionally, without\nchecking netif_running(). ResetAdapter() first calls card_stop(), which\nsets smc->hw.hw_state to STOPPED, and then mac_drv_clear_tx_queue(),\nwhich walks the two transmit queues:\n\n\tfor (i = QUEUE_S; i <= QUEUE_A0; i++) {\n\t\tqueue = smc->hw.fp.tx[i] ;\n\t\t...\n\t\tt = queue->tx_curr_get ;\n\nsmc->hw.fp.tx[] is only populated by init_tx(), which is reached from\nskfp_open() through init_smt() -> init_fddi_driver() -> init_fplus() ->\ninit_mac() -> init_tx(). The private area is allocated and zeroed by\nalloc_fddidev(), so on an interface that has never been brought up both\nqueue pointers are still NULL. The hw_state test at the top of\nmac_drv_clear_tx_queue() does not catch this, because card_stop() has\njust set STOPPED; the function proceeds into the loop and dereferences\nNULL. ResetAdapter() does call init_smt() itself, but only after the\nqueues have been cleared.\n\nSetting the MAC address on a down interface therefore oopses:\n\n  ip link set dev fddi0 address 02:00:00:00:00:01\n\n  BUG: KASAN: null-ptr-deref in mac_drv_clear_tx_queue+0x68/0x2c0 [skfp]\n  Read of size 8 at addr 0000000000000010 by task ip/302\n  Call Trace:\n   <TASK>\n   mac_drv_clear_tx_queue+0x68/0x2c0 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n   ResetAdapter+0x29/0x100 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n   skfp_ctl_set_mac_address+0x57/0x80 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n   netif_set_mac_address+0x1e4/0x2c0\n   do_setlink+0x684/0x2680\n   </TASK>\n\nAddress 0x10 is the offset of tx_curr_get, the third pointer in\nstruct s_smt_tx_queue, on 64-bit. mac_drv_clear_rx_queue(), which\nResetAdapter() calls immediately afterwards, dereferences\nsmc->hw.fp.rx[QUEUE_R1] in the same way behind the same ineffective\nhw_state test; the transmit queue merely crashes first. Both are\ncovered by the guard below.\n\nSkip the adapter reset when the interface is down. dev_addr_set() is\nleft unconditional, so the new address is still recorded in\ndev->dev_addr. Nothing is lost by not resetting the adapter here:\nskfp_open() deliberately re-reads the factory address on every open,\n\n\tread_address(smc, NULL);\n\teth_hw_addr_set(dev, smc->hw.fddi_canon_addr.a);\n\nand the comment above it states this is done to discard exactly such an\naddress override across a close/open cycle. An address set while the\ninterface is down could not have survived the following open even\nbefore this change, so the guard removes no working behaviour. Guarding\nthe hardware side of ndo_set_mac_address() with netif_running() is\nestablished practice; skge_set_mac_address() has done so since commit\n2eb3e621c4e0 (\"skge: set mac address bonding fix\").\n\nGuarding the reset as a whole, rather than NULL-checking the queues, is\nalso what the rest of the driver expects. After a previous open/close\nthe queue pointers are stale but non-NULL, so there is no crash, yet\nResetAdapter() goes on to call smt_online() and STI_FBI() (\"Enable\nBoard Interrupts\") while skfp_close() has already called free_irq() -\nthe adapter would be brought back online with no handler installed. The\nonly other ResetAdapter() caller is skfp_interrupt(), which by\nconstruction runs only while the device is open.\n\nFound by automated driver testing against an emulated SysKonnect FDDI\nadapter under a KASAN-enabled 7.0.0 kernel. Triggering it requires\nCAP_NET_ADMIN.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-06 09:18:21","updated_at":"2026-10-06 09:18:21"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/7c8810c2e69c3d9ca6df870b40ae9218e50b4fb1","name":"https://git.kernel.org/stable/c/7c8810c2e69c3d9ca6df870b40ae9218e50b4fb1","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/5fd0f401b3eee95c93daa35ef99cb03d676031f0","name":"https://git.kernel.org/stable/c/5fd0f401b3eee95c93daa35ef99cb03d676031f0","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/822903ed991971780db1db1be31a4f00e2b13e30","name":"https://git.kernel.org/stable/c/822903ed991971780db1db1be31a4f00e2b13e30","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/438131e7ae847e907d345bf504d7e25585561b5c","name":"https://git.kernel.org/stable/c/438131e7ae847e907d345bf504d7e25585561b5c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/616ba18b2cfb72b7bea214bdd72df2485b2e37dc","name":"https://git.kernel.org/stable/c/616ba18b2cfb72b7bea214bdd72df2485b2e37dc","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/731db6110b3148331ed8d5d11a564bfd520721d9","name":"https://git.kernel.org/stable/c/731db6110b3148331ed8d5d11a564bfd520721d9","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/835903bea770ad96ab4322e18d98e00f8e0b39c3","name":"https://git.kernel.org/stable/c/835903bea770ad96ab4322e18d98e00f8e0b39c3","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d6f63fdb298d546a47790cb373db65462c264d04","name":"https://git.kernel.org/stable/c/d6f63fdb298d546a47790cb373db65462c264d04","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98302","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98302","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 835903bea770ad96ab4322e18d98e00f8e0b39c3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 5fd0f401b3eee95c93daa35ef99cb03d676031f0 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 731db6110b3148331ed8d5d11a564bfd520721d9 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 822903ed991971780db1db1be31a4f00e2b13e30 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 616ba18b2cfb72b7bea214bdd72df2485b2e37dc git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 d6f63fdb298d546a47790cb373db65462c264d04 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 438131e7ae847e907d345bf504d7e25585561b5c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 7c8810c2e69c3d9ca6df870b40ae9218e50b4fb1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.12","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.12 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.271 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.222 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.189 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.158 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.112 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.54 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.8 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc4 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"98302","cve":"CVE-2026-98302","epss":"0.001840000","percentile":"0.072970000","score_date":"2026-10-06","updated_at":"2026-10-07 00:14:55"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/fddi/skfp/skfddi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"835903bea770ad96ab4322e18d98e00f8e0b39c3","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"5fd0f401b3eee95c93daa35ef99cb03d676031f0","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"731db6110b3148331ed8d5d11a564bfd520721d9","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"822903ed991971780db1db1be31a4f00e2b13e30","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"616ba18b2cfb72b7bea214bdd72df2485b2e37dc","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"d6f63fdb298d546a47790cb373db65462c264d04","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"438131e7ae847e907d345bf504d7e25585561b5c","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"7c8810c2e69c3d9ca6df870b40ae9218e50b4fb1","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/fddi/skfp/skfddi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.271","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.222","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.189","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.158","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.112","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.54","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.8","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc4","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.271","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.222","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.189","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.158","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.112","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.54","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.8","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc4","versionStartIncluding":"2.6.12","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fddi: skfp: fix NULL deref when setting the MAC address while down\n\nskfp_ctl_set_mac_address() calls ResetAdapter() unconditionally, without\nchecking netif_running(). ResetAdapter() first calls card_stop(), which\nsets smc->hw.hw_state to STOPPED, and then mac_drv_clear_tx_queue(),\nwhich walks the two transmit queues:\n\n\tfor (i = QUEUE_S; i <= QUEUE_A0; i++) {\n\t\tqueue = smc->hw.fp.tx[i] ;\n\t\t...\n\t\tt = queue->tx_curr_get ;\n\nsmc->hw.fp.tx[] is only populated by init_tx(), which is reached from\nskfp_open() through init_smt() -> init_fddi_driver() -> init_fplus() ->\ninit_mac() -> init_tx(). The private area is allocated and zeroed by\nalloc_fddidev(), so on an interface that has never been brought up both\nqueue pointers are still NULL. The hw_state test at the top of\nmac_drv_clear_tx_queue() does not catch this, because card_stop() has\njust set STOPPED; the function proceeds into the loop and dereferences\nNULL. ResetAdapter() does call init_smt() itself, but only after the\nqueues have been cleared.\n\nSetting the MAC address on a down interface therefore oopses:\n\n  ip link set dev fddi0 address 02:00:00:00:00:01\n\n  BUG: KASAN: null-ptr-deref in mac_drv_clear_tx_queue+0x68/0x2c0 [skfp]\n  Read of size 8 at addr 0000000000000010 by task ip/302\n  Call Trace:\n   <TASK>\n   mac_drv_clear_tx_queue+0x68/0x2c0 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n   ResetAdapter+0x29/0x100 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n   skfp_ctl_set_mac_address+0x57/0x80 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n   netif_set_mac_address+0x1e4/0x2c0\n   do_setlink+0x684/0x2680\n   </TASK>\n\nAddress 0x10 is the offset of tx_curr_get, the third pointer in\nstruct s_smt_tx_queue, on 64-bit. mac_drv_clear_rx_queue(), which\nResetAdapter() calls immediately afterwards, dereferences\nsmc->hw.fp.rx[QUEUE_R1] in the same way behind the same ineffective\nhw_state test; the transmit queue merely crashes first. Both are\ncovered by the guard below.\n\nSkip the adapter reset when the interface is down. dev_addr_set() is\nleft unconditional, so the new address is still recorded in\ndev->dev_addr. Nothing is lost by not resetting the adapter here:\nskfp_open() deliberately re-reads the factory address on every open,\n\n\tread_address(smc, NULL);\n\teth_hw_addr_set(dev, smc->hw.fddi_canon_addr.a);\n\nand the comment above it states this is done to discard exactly such an\naddress override across a close/open cycle. An address set while the\ninterface is down could not have survived the following open even\nbefore this change, so the guard removes no working behaviour. Guarding\nthe hardware side of ndo_set_mac_address() with netif_running() is\nestablished practice; skge_set_mac_address() has done so since commit\n2eb3e621c4e0 (\"skge: set mac address bonding fix\").\n\nGuarding the reset as a whole, rather than NULL-checking the queues, is\nalso what the rest of the driver expects. After a previous open/close\nthe queue pointers are stale but non-NULL, so there is no crash, yet\nResetAdapter() goes on to call smt_online() and STI_FBI() (\"Enable\nBoard Interrupts\") while skfp_close() has already called free_irq() -\nthe adapter would be brought back online with no handler installed. The\nonly other ResetAdapter() caller is skfp_interrupt(), which by\nconstruction runs only while the device is open.\n\nFound by automated driver testing against an emulated SysKonnect FDDI\nadapter under a KASAN-enabled 7.0.0 kernel. Triggering it requires\nCAP_NET_ADMIN."}],"providerMetadata":{"dateUpdated":"2026-10-06T08:45:59.718Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/835903bea770ad96ab4322e18d98e00f8e0b39c3"},{"url":"https://git.kernel.org/stable/c/5fd0f401b3eee95c93daa35ef99cb03d676031f0"},{"url":"https://git.kernel.org/stable/c/731db6110b3148331ed8d5d11a564bfd520721d9"},{"url":"https://git.kernel.org/stable/c/822903ed991971780db1db1be31a4f00e2b13e30"},{"url":"https://git.kernel.org/stable/c/616ba18b2cfb72b7bea214bdd72df2485b2e37dc"},{"url":"https://git.kernel.org/stable/c/d6f63fdb298d546a47790cb373db65462c264d04"},{"url":"https://git.kernel.org/stable/c/438131e7ae847e907d345bf504d7e25585561b5c"},{"url":"https://git.kernel.org/stable/c/7c8810c2e69c3d9ca6df870b40ae9218e50b4fb1"}],"title":"net: fddi: skfp: fix NULL deref when setting the MAC address while down","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98302","datePublished":"2026-10-06T08:45:59.718Z","dateReserved":"2026-09-25T10:25:14.337Z","dateUpdated":"2026-10-06T08:45:59.718Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-06 09:18:21","lastModifiedDate":"2026-10-06 09:18:21","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98302","Ordinal":"1","Title":"net: fddi: skfp: fix NULL deref when setting the MAC address whi","CVE":"CVE-2026-98302","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98302","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fddi: skfp: fix NULL deref when setting the MAC address while down\n\nskfp_ctl_set_mac_address() calls ResetAdapter() unconditionally, without\nchecking netif_running(). ResetAdapter() first calls card_stop(), which\nsets smc->hw.hw_state to STOPPED, and then mac_drv_clear_tx_queue(),\nwhich walks the two transmit queues:\n\n\tfor (i = QUEUE_S; i <= QUEUE_A0; i++) {\n\t\tqueue = smc->hw.fp.tx[i] ;\n\t\t...\n\t\tt = queue->tx_curr_get ;\n\nsmc->hw.fp.tx[] is only populated by init_tx(), which is reached from\nskfp_open() through init_smt() -> init_fddi_driver() -> init_fplus() ->\ninit_mac() -> init_tx(). The private area is allocated and zeroed by\nalloc_fddidev(), so on an interface that has never been brought up both\nqueue pointers are still NULL. The hw_state test at the top of\nmac_drv_clear_tx_queue() does not catch this, because card_stop() has\njust set STOPPED; the function proceeds into the loop and dereferences\nNULL. ResetAdapter() does call init_smt() itself, but only after the\nqueues have been cleared.\n\nSetting the MAC address on a down interface therefore oopses:\n\n  ip link set dev fddi0 address 02:00:00:00:00:01\n\n  BUG: KASAN: null-ptr-deref in mac_drv_clear_tx_queue+0x68/0x2c0 [skfp]\n  Read of size 8 at addr 0000000000000010 by task ip/302\n  Call Trace:\n   <TASK>\n   mac_drv_clear_tx_queue+0x68/0x2c0 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n   ResetAdapter+0x29/0x100 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n   skfp_ctl_set_mac_address+0x57/0x80 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n   netif_set_mac_address+0x1e4/0x2c0\n   do_setlink+0x684/0x2680\n   </TASK>\n\nAddress 0x10 is the offset of tx_curr_get, the third pointer in\nstruct s_smt_tx_queue, on 64-bit. mac_drv_clear_rx_queue(), which\nResetAdapter() calls immediately afterwards, dereferences\nsmc->hw.fp.rx[QUEUE_R1] in the same way behind the same ineffective\nhw_state test; the transmit queue merely crashes first. Both are\ncovered by the guard below.\n\nSkip the adapter reset when the interface is down. dev_addr_set() is\nleft unconditional, so the new address is still recorded in\ndev->dev_addr. Nothing is lost by not resetting the adapter here:\nskfp_open() deliberately re-reads the factory address on every open,\n\n\tread_address(smc, NULL);\n\teth_hw_addr_set(dev, smc->hw.fddi_canon_addr.a);\n\nand the comment above it states this is done to discard exactly such an\naddress override across a close/open cycle. An address set while the\ninterface is down could not have survived the following open even\nbefore this change, so the guard removes no working behaviour. Guarding\nthe hardware side of ndo_set_mac_address() with netif_running() is\nestablished practice; skge_set_mac_address() has done so since commit\n2eb3e621c4e0 (\"skge: set mac address bonding fix\").\n\nGuarding the reset as a whole, rather than NULL-checking the queues, is\nalso what the rest of the driver expects. After a previous open/close\nthe queue pointers are stale but non-NULL, so there is no crash, yet\nResetAdapter() goes on to call smt_online() and STI_FBI() (\"Enable\nBoard Interrupts\") while skfp_close() has already called free_irq() -\nthe adapter would be brought back online with no handler installed. The\nonly other ResetAdapter() caller is skfp_interrupt(), which by\nconstruction runs only while the device is open.\n\nFound by automated driver testing against an emulated SysKonnect FDDI\nadapter under a KASAN-enabled 7.0.0 kernel. Triggering it requires\nCAP_NET_ADMIN.","Type":"Description","Title":"net: fddi: skfp: fix NULL deref when setting the MAC address whi"}]}}}