lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 27 May 2020 20:21:33 -0700 From: Xie He <hexie3605@...il.com> To: "David S. Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, Madhuparna Bhowmik <madhuparnabhowmik04@...il.com>, Xie He <hexie3605@...il.com>, netdev@...r.kernel.org, linux-kernel@...r.kernel.org Subject: [PATCH] drivers/net/wan/lapbether.c: Fixed kernel panic when used with AF_PACKET sockets When we use "AF_PACKET" sockets to send data directly over LAPB over Ethernet using this driver, the kernel will panic because of insufficient header space allocated in the "sk_buff" struct. The header space needs 18 bytes because: the lapbether driver will remove a pseudo header of 1 byte; the lapb module will prepend the LAPB header of 2 or 3 bytes; the lapbether driver will prepend a length field of 2 bytes and the Ethernet header of 14 bytes. So -1 + 3 + 16 = 18. Signed-off-by: Xie He <hexie3605@...il.com> --- drivers/net/wan/lapbether.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c index e30d91a38cfb..619413f5d432 100644 --- a/drivers/net/wan/lapbether.c +++ b/drivers/net/wan/lapbether.c @@ -303,7 +303,8 @@ static void lapbeth_setup(struct net_device *dev) dev->netdev_ops = &lapbeth_netdev_ops; dev->needs_free_netdev = true; dev->type = ARPHRD_X25; - dev->hard_header_len = 3; + /* 18 = -1 (lapbether) + 3 (lapb) + 16 (lapbether) */ + dev->hard_header_len = 18; dev->mtu = 1000; dev->addr_len = 0; } -- 2.25.1
Powered by blists - more mailing lists