]> git.proxmox.com Git - mirror_ubuntu-focal-kernel.git/commit
airo: Fix read overflows sending packets
authorDan Carpenter <dan.carpenter@oracle.com>
Wed, 27 May 2020 18:48:30 +0000 (21:48 +0300)
committerKhalid Elmously <khalid.elmously@canonical.com>
Sat, 8 Aug 2020 05:53:12 +0000 (01:53 -0400)
commit0f48fbd9cebc58141e761551fe551b1dd23cd90b
treee52cc5826f9e217c9ff940353e12fe9696749bc9
parent9536f52a9037c91f3244337d0d7281d55ffb2e6a
airo: Fix read overflows sending packets

BugLink: https://bugs.launchpad.net/bugs/1882802
commit 11e7a91994c29da96d847f676be023da6a2c1359 upstream.

The problem is that we always copy a minimum of ETH_ZLEN (60) bytes from
skb->data even when skb->len is less than ETH_ZLEN so it leads to a read
overflow.

The fix is to pad skb->data to at least ETH_ZLEN bytes.

Cc: <stable@vger.kernel.org>
Reported-by: Hu Jiahui <kirin.say@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200527184830.GA1164846@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>
drivers/net/wireless/cisco/airo.c