imrcpan/erofs-linux
1
0 Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git synced 2026-11-01 06:46:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

net: hsr: check skb can contain struct hsr_ethhdr in fill_frame_info

Browse Source 
Check at start of fill_frame_info that the MAC header in the supplied
skb is large enough to fit a struct hsr_ethhdr, as otherwise this is
not a valid HSR frame. If it is too small, return an error which will
then cause the callers to clean up the skb. Fixes a KMSAN-found
uninit-value bug reported by syzbot at:
https://syzkaller.appspot.com/bug?id=f7e9b601f1414f814f7602a82b6619a8d80bce3f

Reported-by: [email protected]
Signed-off-by: Phillip Potter <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
This commit is contained in:
Phillip Potter authored and David S. Miller committed 2021-05-03 13:33:54 -07:00
1 parent f282df0391
commit 2e9f60932a
1 file changed
+4
Download Patch File Download Diff File Expand all files Collapse all files
net/hsr/hsr_forward.c
+4
View File
@@ -520,6 +520,10 @@ static int fill_frame_info(struct hsr_frame_info *frame,
struct ethhdr *ethhdr;
__be16 proto;
/* Check if skb contains hsr_ethhdr */
if (skb->mac_len < sizeof(struct hsr_ethhdr))
return -EINVAL;
memset(frame, 0, sizeof(*frame));
frame->is_supervision = is_supervision_frame(port->hsr, skb);
frame->node_src = hsr_get_node(port, &hsr->node_db, skb,