summaryrefslogtreecommitdiff
path: root/net/packet
diff options
context:
space:
mode:
authorJakub Kicinski <kuba@kernel.org>2022-03-17 23:56:06 +0300
committerJakub Kicinski <kuba@kernel.org>2022-03-17 23:56:58 +0300
commite243f39685af1bd6d837fa7bff40c1afdf3eb7fa (patch)
tree61e9d9b74a0814f950a693ebe8061293e4960b1e /net/packet
parent1abea24af42c35c6eb537e4402836e2cde2a5b13 (diff)
parent551acdc3c3d2b6bc97f11e31dcf960bc36343bfc (diff)
downloadlinux-e243f39685af1bd6d837fa7bff40c1afdf3eb7fa.tar.xz
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
No conflicts. Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net/packet')
-rw-r--r--net/packet/af_packet.c11
1 files changed, 10 insertions, 1 deletions
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 1b93ce1a5600..c39c09899fd0 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2318,8 +2318,11 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
copy_skb = skb_get(skb);
skb_head = skb->data;
}
- if (copy_skb)
+ if (copy_skb) {
+ memset(&PACKET_SKB_CB(copy_skb)->sa.ll, 0,
+ sizeof(PACKET_SKB_CB(copy_skb)->sa.ll));
skb_set_owner_r(copy_skb, sk);
+ }
}
snaplen = po->rx_ring.frame_size - macoff;
if ((int)snaplen < 0) {
@@ -3464,6 +3467,8 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
sock_recv_ts_and_drops(msg, sk, skb);
if (msg->msg_name) {
+ const size_t max_len = min(sizeof(skb->cb),
+ sizeof(struct sockaddr_storage));
int copy_len;
/* If the address length field is there to be filled
@@ -3486,6 +3491,10 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
msg->msg_namelen = sizeof(struct sockaddr_ll);
}
}
+ if (WARN_ON_ONCE(copy_len > max_len)) {
+ copy_len = max_len;
+ msg->msg_namelen = copy_len;
+ }
memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len);
}