diff options
author | Phillip Potter <phil@philpotter.co.uk> | 2021-05-03 00:34:42 +0300 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-05-22 12:40:54 +0300 |
commit | 86587f35cba979c2d55376d08a9d553d846e84a5 (patch) | |
tree | 8fb1eac345109bb86ae21c6d3f597a452ea6f3dc /net/hsr | |
parent | 82646b1844a21473129c5e8c381a087e1f59a22a (diff) | |
download | linux-86587f35cba979c2d55376d08a9d553d846e84a5.tar.xz |
net: hsr: check skb can contain struct hsr_ethhdr in fill_frame_info
[ Upstream commit 2e9f60932a2c19e8a11b4a69d419f107024b05a0 ]
Check at start of fill_frame_info that the MAC header in the supplied
skb is large enough to fit a struct hsr_ethhdr, as otherwise this is
not a valid HSR frame. If it is too small, return an error which will
then cause the callers to clean up the skb. Fixes a KMSAN-found
uninit-value bug reported by syzbot at:
https://syzkaller.appspot.com/bug?id=f7e9b601f1414f814f7602a82b6619a8d80bce3f
Reported-by: syzbot+e267bed19bfc5478fb33@syzkaller.appspotmail.com
Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net/hsr')
-rw-r--r-- | net/hsr/hsr_forward.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c index b4e06ae08834..90c72e4c0a8f 100644 --- a/net/hsr/hsr_forward.c +++ b/net/hsr/hsr_forward.c @@ -493,6 +493,10 @@ static int fill_frame_info(struct hsr_frame_info *frame, struct ethhdr *ethhdr; __be16 proto; + /* Check if skb contains hsr_ethhdr */ + if (skb->mac_len < sizeof(struct hsr_ethhdr)) + return -EINVAL; + memset(frame, 0, sizeof(*frame)); frame->is_supervision = is_supervision_frame(port->hsr, skb); frame->node_src = hsr_get_node(port, &hsr->node_db, skb, |