airo: Fix read overflows sending packets (11e7a919) · Commits · 戴 / test

The problem is that we always copy a minimum of ETH_ZLEN (60) bytes from skb->data even when skb->len is less than ETH_ZLEN so it leads to a read overflow. The fix is to pad skb->data to at least ETH_ZLEN bytes. Cc: <stable@vger.kernel.org> Reported-by:

Hu Jiahui <kirin.say@gmail.com> Signed-off-by:

Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by:

Eric Dumazet <edumazet@google.com> Signed-off-by:

Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200527184830.GA1164846@mwanda

drivers/net/wireless/cisco/airo.c

+12 −0

Original line number	Diff line number	Diff line
		@@ -1925,6 +1925,10 @@ static netdev_tx_t mpi_start_xmit(struct sk_buff *skb,
		airo_print_err(dev->name, "%s: skb == NULL!",__func__);
		return NETDEV_TX_OK;
		}
		if (skb_padto(skb, ETH_ZLEN)) {
		dev->stats.tx_dropped++;
		return NETDEV_TX_OK;
		}
		npacks = skb_queue_len (&ai->txq);

		if (npacks >= MAXTXQ - 1) {
		@@ -2127,6 +2131,10 @@ static netdev_tx_t airo_start_xmit(struct sk_buff *skb,
		airo_print_err(dev->name, "%s: skb == NULL!", __func__);
		return NETDEV_TX_OK;
		}
		if (skb_padto(skb, ETH_ZLEN)) {
		dev->stats.tx_dropped++;
		return NETDEV_TX_OK;
		}

		/* Find a vacant FID */
		for( i = 0; i < MAX_FIDS / 2 && (fids[i] & 0xffff0000); i++ );
		@@ -2201,6 +2209,10 @@ static netdev_tx_t airo_start_xmit11(struct sk_buff *skb,
		airo_print_err(dev->name, "%s: skb == NULL!", __func__);
		return NETDEV_TX_OK;
		}
		if (skb_padto(skb, ETH_ZLEN)) {
		dev->stats.tx_dropped++;
		return NETDEV_TX_OK;
		}

		/* Find a vacant FID */
		for( i = MAX_FIDS / 2; i < MAX_FIDS && (fids[i] & 0xffff0000); i++ );

Admin message