| Message ID | 20200527133301.GL22511@kadam (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | [resend] airo: Fix read overflow in mpi_send_packet() | expand |
On Wed, May 27, 2020 at 6:37 AM Dan Carpenter <dan.carpenter@oracle.com> wrote: > > The problem is that we always copy a minimum of ETH_ZLEN (60) bytes from > skb->data even when skb->len is less than ETH_ZLEN so it leads to a read > overflow. > > The fix for is to pad skb->data with zeroes so that it's never less than > ETH_ZLEN bytes. > > c: <stable@vger.kernel.org> > Reported-by: Hu Jiahui <kirin.say@gmail.com> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > Resending to the public lists so that it can go through the normal > review process. > > My other concern with this driver is why is the ->max_mtu 2400 when it > looks like we are allocating PKTSIZE (1840) byte buffers to hold it in > mpi_map_card()? I don't fully understand the code but that seems like > it could be a buffer overflow as well. I'm not sure what the > appropriate fix is for that. > > drivers/net/wireless/cisco/airo.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c > index 8363f91df7ea7..7c5634f72cc72 100644 > --- a/drivers/net/wireless/cisco/airo.c > +++ b/drivers/net/wireless/cisco/airo.c > @@ -1925,6 +1925,11 @@ static netdev_tx_t mpi_start_xmit(struct sk_buff *skb, > airo_print_err(dev->name, "%s: skb == NULL!",__func__); > return NETDEV_TX_OK; > } > + if (skb->len < ETH_ZLEN) { No need to duplicate the test. Just use if (skb_padto(skb, ETH_ZLEN)) { dev->stats.tx_dropped++; return NETDEV_TX_OK; } > + if (skb_padto(skb, ETH_ZLEN)) > + return NETDEV_TX_OK; > + } > + > npacks = skb_queue_len (&ai->txq); > > if (npacks >= MAXTXQ - 1) { > @@ -1975,8 +1980,7 @@ static int mpi_send_packet (struct net_device *dev) > return 0; > } > > - /* check min length*/ > - len = ETH_ZLEN < skb->len ? skb->len : ETH_ZLEN; > + len = skb->len; > buffer = skb->data; > > ai->txfids[0].tx_desc.offset = 0; > -- > 2.26.2
diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c index 8363f91df7ea7..7c5634f72cc72 100644 --- a/drivers/net/wireless/cisco/airo.c +++ b/drivers/net/wireless/cisco/airo.c @@ -1925,6 +1925,11 @@ static netdev_tx_t mpi_start_xmit(struct sk_buff *skb, airo_print_err(dev->name, "%s: skb == NULL!",__func__); return NETDEV_TX_OK; } + if (skb->len < ETH_ZLEN) { + if (skb_padto(skb, ETH_ZLEN)) + return NETDEV_TX_OK; + } + npacks = skb_queue_len (&ai->txq); if (npacks >= MAXTXQ - 1) { @@ -1975,8 +1980,7 @@ static int mpi_send_packet (struct net_device *dev) return 0; } - /* check min length*/ - len = ETH_ZLEN < skb->len ? skb->len : ETH_ZLEN; + len = skb->len; buffer = skb->data; ai->txfids[0].tx_desc.offset = 0;
The problem is that we always copy a minimum of ETH_ZLEN (60) bytes from skb->data even when skb->len is less than ETH_ZLEN so it leads to a read overflow. The fix for is to pad skb->data with zeroes so that it's never less than ETH_ZLEN bytes. c: <stable@vger.kernel.org> Reported-by: Hu Jiahui <kirin.say@gmail.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- Resending to the public lists so that it can go through the normal review process. My other concern with this driver is why is the ->max_mtu 2400 when it looks like we are allocating PKTSIZE (1840) byte buffers to hold it in mpi_map_card()? I don't fully understand the code but that seems like it could be a buffer overflow as well. I'm not sure what the appropriate fix is for that. drivers/net/wireless/cisco/airo.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)