summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPhillip Potter <phil@philpotter.co.uk>2021-05-03 00:34:42 +0300
committerDavid S. Miller <davem@davemloft.net>2021-05-03 23:33:54 +0300
commit2e9f60932a2c19e8a11b4a69d419f107024b05a0 (patch)
treec5fa8f27999183303b4c1394136a33388adb471c
parentf282df0391267fb2b263da1cc3233aa6fb81defc (diff)
downloadlinux-2e9f60932a2c19e8a11b4a69d419f107024b05a0.tar.xz
net: hsr: check skb can contain struct hsr_ethhdr in fill_frame_info
Check at start of fill_frame_info that the MAC header in the supplied skb is large enough to fit a struct hsr_ethhdr, as otherwise this is not a valid HSR frame. If it is too small, return an error which will then cause the callers to clean up the skb. Fixes a KMSAN-found uninit-value bug reported by syzbot at: https://syzkaller.appspot.com/bug?id=f7e9b601f1414f814f7602a82b6619a8d80bce3f Reported-by: syzbot+e267bed19bfc5478fb33@syzkaller.appspotmail.com Signed-off-by: Phillip Potter <phil@philpotter.co.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/hsr/hsr_forward.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index b218e4594009..6852e9bccf5b 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -520,6 +520,10 @@ static int fill_frame_info(struct hsr_frame_info *frame,
struct ethhdr *ethhdr;
__be16 proto;
+ /* Check if skb contains hsr_ethhdr */
+ if (skb->mac_len < sizeof(struct hsr_ethhdr))
+ return -EINVAL;
+
memset(frame, 0, sizeof(*frame));
frame->is_supervision = is_supervision_frame(port->hsr, skb);
frame->node_src = hsr_get_node(port, &hsr->node_db, skb,