Commit b82573fd authored Aug 26, 2019 by Christophe JAILLET Committed by David S. Miller Sep 07, 2019

net/hamradio/6pack: Fix the size of a sk_buff used in 'sp_bump()'



We 'allocate' 'count' bytes here. In fact, 'dev_alloc_skb' already add some
extra space for padding, so a bit more is allocated.

However, we use 1 byte for the KISS command, then copy 'count' bytes, so
count+1 bytes.

Explicitly allocate and use 1 more byte to be safe.

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 0c04eb72

drivers/net/hamradio/6pack.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -344,10 +344,10 @@ static void sp_bump(struct sixpack *sp, char cmd)

		sp->dev->stats.rx_bytes += count;

		if ((skb = dev_alloc_skb(count)) == NULL)
		if ((skb = dev_alloc_skb(count + 1)) == NULL)
		goto out_mem;

		ptr = skb_put(skb, count);
		ptr = skb_put(skb, count + 1);
		ptr++ = cmd; / KISS command */

		memcpy(ptr, sp->cooked_buf + 1, count);

Admin message