netdev - [PATCH net] net: mhi: set skb mac header before entering RX path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 13 May 2024 15:38:30 +0200
From: Martin Fäcknitz <faecknitz@...splots.de>
To: netdev@...r.kernel.org
Cc: Martin Fäcknitz <faecknitz@...splots.de>
Subject: [PATCH net] net: mhi: set skb mac header before entering RX path

skb->mac_header must be set before passing the skb to the network stack,
because skb->mac_len is calculated from skb->mac_header in
__netif_receive_skb_core.

Some network stack components, like xfrm, are using skb->mac_len to
check for an existing MAC header, which doesn't exist in this case. This
leads to memory corruption.

Signed-off-by: Martin Fäcknitz <faecknitz@...splots.de>
---
 drivers/net/mhi_net.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/mhi_net.c b/drivers/net/mhi_net.c
index ae169929a9d8..e432efddcb22 100644
--- a/drivers/net/mhi_net.c
+++ b/drivers/net/mhi_net.c
@@ -221,6 +221,8 @@ static void mhi_net_dl_callback(struct mhi_device *mhi_dev,
 			break;
 		}
 
+		skb_reset_mac_header(skb);
+
 		u64_stats_update_begin(&mhi_netdev->stats.rx_syncp);
 		u64_stats_inc(&mhi_netdev->stats.rx_packets);
 		u64_stats_add(&mhi_netdev->stats.rx_bytes, skb->len);
-- 
2.11.0