ieee802154: verify packet size before trying to allocate it (3da947b2) · Commits · 戴 / test

Currently when sending data over datagram, the send function will attempt to allocate any size passed on from the userspace. We should make sure that this size is checked and limited. We'll limit it to the MTU of the device, which is checked later anyway. Signed-off-by:

Sasha Levin <levinsasha928@gmail.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ieee802154/dgram.c

+6 −6

Original line number	Diff line number	Diff line
		@@ -230,6 +230,12 @@ static int dgram_sendmsg(struct kiocb iocb, struct sock sk,
		mtu = dev->mtu;
		pr_debug("name = %s, mtu = %u\n", dev->name, mtu);

		if (size > mtu) {
		pr_debug("size = %Zu, mtu = %u\n", size, mtu);
		err = -EINVAL;
		goto out_dev;
		}

		hlen = LL_RESERVED_SPACE(dev);
		tlen = dev->needed_tailroom;
		skb = sock_alloc_send_skb(sk, hlen + tlen + size,
		@@ -258,12 +264,6 @@ static int dgram_sendmsg(struct kiocb iocb, struct sock sk,
		if (err < 0)
		goto out_skb;

		if (size > mtu) {
		pr_debug("size = %Zu, mtu = %u\n", size, mtu);
		err = -EINVAL;
		goto out_skb;
		}

		skb->dev = dev;
		skb->sk = sk;
		skb->protocol = htons(ETH_P_IEEE802154);

Admin message