mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-20 01:20:54 +00:00
net: hsr: check skb can contain struct hsr_ethhdr in fill_frame_info
[ Upstream commit 2e9f60932a
]
Check at start of fill_frame_info that the MAC header in the supplied
skb is large enough to fit a struct hsr_ethhdr, as otherwise this is
not a valid HSR frame. If it is too small, return an error which will
then cause the callers to clean up the skb. Fixes a KMSAN-found
uninit-value bug reported by syzbot at:
https://syzkaller.appspot.com/bug?id=f7e9b601f1414f814f7602a82b6619a8d80bce3f
Reported-by: syzbot+e267bed19bfc5478fb33@syzkaller.appspotmail.com
Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
82646b1844
commit
86587f35cb
1 changed files with 4 additions and 0 deletions
|
@ -493,6 +493,10 @@ static int fill_frame_info(struct hsr_frame_info *frame,
|
|||
struct ethhdr *ethhdr;
|
||||
__be16 proto;
|
||||
|
||||
/* Check if skb contains hsr_ethhdr */
|
||||
if (skb->mac_len < sizeof(struct hsr_ethhdr))
|
||||
return -EINVAL;
|
||||
|
||||
memset(frame, 0, sizeof(*frame));
|
||||
frame->is_supervision = is_supervision_frame(port->hsr, skb);
|
||||
frame->node_src = hsr_get_node(port, &hsr->node_db, skb,
|
||||
|
|
Loading…
Reference in a new issue