diff mbox series

[resend] airo: Fix read overflow in mpi_send_packet()

Message ID 20200527133301.GL22511@kadam (mailing list archive)
State Changes Requested
Delegated to: Kalle Valo
Headers show
Series [resend] airo: Fix read overflow in mpi_send_packet() | expand

Commit Message

Dan Carpenter May 27, 2020, 1:36 p.m. UTC
The problem is that we always copy a minimum of ETH_ZLEN (60) bytes from
skb->data even when skb->len is less than ETH_ZLEN so it leads to a read
overflow.

The fix for is to pad skb->data with zeroes so that it's never less than
ETH_ZLEN bytes.

c: <stable@vger.kernel.org>
Reported-by: Hu Jiahui <kirin.say@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
Resending to the public lists so that it can go through the normal
review process.

My other concern with this driver is why is the ->max_mtu 2400 when it
looks like we are allocating PKTSIZE (1840) byte buffers to hold it in
mpi_map_card()?  I don't fully understand the code but that seems like
it could be a buffer overflow as well.  I'm not sure what the
appropriate fix is for that.

 drivers/net/wireless/cisco/airo.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

Comments

Eric Dumazet May 27, 2020, 4:52 p.m. UTC | #1
On Wed, May 27, 2020 at 6:37 AM Dan Carpenter <dan.carpenter@oracle.com> wrote:
>
> The problem is that we always copy a minimum of ETH_ZLEN (60) bytes from
> skb->data even when skb->len is less than ETH_ZLEN so it leads to a read
> overflow.
>
> The fix for is to pad skb->data with zeroes so that it's never less than
> ETH_ZLEN bytes.
>
> c: <stable@vger.kernel.org>
> Reported-by: Hu Jiahui <kirin.say@gmail.com>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> Resending to the public lists so that it can go through the normal
> review process.
>
> My other concern with this driver is why is the ->max_mtu 2400 when it
> looks like we are allocating PKTSIZE (1840) byte buffers to hold it in
> mpi_map_card()?  I don't fully understand the code but that seems like
> it could be a buffer overflow as well.  I'm not sure what the
> appropriate fix is for that.
>
>  drivers/net/wireless/cisco/airo.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
> index 8363f91df7ea7..7c5634f72cc72 100644
> --- a/drivers/net/wireless/cisco/airo.c
> +++ b/drivers/net/wireless/cisco/airo.c
> @@ -1925,6 +1925,11 @@ static netdev_tx_t mpi_start_xmit(struct sk_buff *skb,
>                 airo_print_err(dev->name, "%s: skb == NULL!",__func__);
>                 return NETDEV_TX_OK;
>         }
> +       if (skb->len < ETH_ZLEN) {

No need to duplicate the test.

Just use

       if (skb_padto(skb, ETH_ZLEN)) {
              dev->stats.tx_dropped++;
              return NETDEV_TX_OK;
       }

> +               if (skb_padto(skb, ETH_ZLEN))
> +                       return NETDEV_TX_OK;
> +       }
> +
>         npacks = skb_queue_len (&ai->txq);
>
>         if (npacks >= MAXTXQ - 1) {
> @@ -1975,8 +1980,7 @@ static int mpi_send_packet (struct net_device *dev)
>                 return 0;
>         }
>
> -       /* check min length*/
> -       len = ETH_ZLEN < skb->len ? skb->len : ETH_ZLEN;
> +       len = skb->len;
>         buffer = skb->data;
>
>         ai->txfids[0].tx_desc.offset = 0;
> --
> 2.26.2
diff mbox series

Patch

diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
index 8363f91df7ea7..7c5634f72cc72 100644
--- a/drivers/net/wireless/cisco/airo.c
+++ b/drivers/net/wireless/cisco/airo.c
@@ -1925,6 +1925,11 @@  static netdev_tx_t mpi_start_xmit(struct sk_buff *skb,
 		airo_print_err(dev->name, "%s: skb == NULL!",__func__);
 		return NETDEV_TX_OK;
 	}
+	if (skb->len < ETH_ZLEN) {
+		if (skb_padto(skb, ETH_ZLEN))
+			return NETDEV_TX_OK;
+	}
+
 	npacks = skb_queue_len (&ai->txq);
 
 	if (npacks >= MAXTXQ - 1) {
@@ -1975,8 +1980,7 @@  static int mpi_send_packet (struct net_device *dev)
 		return 0;
 	}
 
-	/* check min length*/
-	len = ETH_ZLEN < skb->len ? skb->len : ETH_ZLEN;
+	len = skb->len;
 	buffer = skb->data;
 
 	ai->txfids[0].tx_desc.offset = 0;