From patchwork Wed Oct 14 16:17:19 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christian Eggers X-Patchwork-Id: 11838061 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22603C433E7 for ; Wed, 14 Oct 2020 16:18:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C0A932224F for ; Wed, 14 Oct 2020 16:18:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731860AbgJNQSO (ORCPT ); Wed, 14 Oct 2020 12:18:14 -0400 Received: from mailout04.rmx.de ([94.199.90.94]:37669 "EHLO mailout04.rmx.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731840AbgJNQSO (ORCPT ); Wed, 14 Oct 2020 12:18:14 -0400 Received: from kdin02.retarus.com (kdin02.dmz1.retloc [172.19.17.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mailout04.rmx.de (Postfix) with ESMTPS id 4CBHdZ2sXGz3qtkv; Wed, 14 Oct 2020 18:18:10 +0200 (CEST) Received: from mta.arri.de (unknown [217.111.95.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by kdin02.retarus.com (Postfix) with ESMTPS id 4CBHcn4nwJz2TTL4; Wed, 14 Oct 2020 18:17:29 +0200 (CEST) Received: from N95HX1G2.wgnetz.xx (192.168.54.83) by mta.arri.de (192.168.100.104) with Microsoft SMTP Server (TLS) id 14.3.408.0; Wed, 14 Oct 2020 18:17:29 +0200 From: Christian Eggers To: Woojung Huh , Andrew Lunn , Vivien Didelot , Florian Fainelli , Vladimir Oltean CC: Microchip Linux Driver Support , "David S . Miller" , Jakub Kicinski , , , Christian Eggers Subject: [PATCH net] net: dsa: ksz: fix padding size of skb Date: Wed, 14 Oct 2020 18:17:19 +0200 Message-ID: <20201014161719.30289-1-ceggers@arri.de> X-Mailer: git-send-email 2.26.2 MIME-Version: 1.0 X-Originating-IP: [192.168.54.83] X-RMX-ID: 20201014-181729-4CBHcn4nwJz2TTL4-0@kdin02 X-RMX-SOURCE: 217.111.95.66 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org __skb_put_padto() is called in order to ensure a minimal size of the sk_buff. The required minimal size is ETH_ZLEN + the size required for the tail tag. The current argument misses the size for the tail tag. The expression "skb->len + padlen" can be simplified to ETH_ZLEN. Too small sk_buffs typically result from cloning in dsa_skb_tx_timestamp(). The cloned sk_buff may not meet the minimum size requirements. Fixes: e71cb9e00922 ("net: dsa: ksz: fix skb freeing") Signed-off-by: Christian Eggers Reviewed-by: Vladimir Oltean --- net/dsa/tag_ksz.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/dsa/tag_ksz.c b/net/dsa/tag_ksz.c index 945a9bd5ba35..8ef2085349e7 100644 --- a/net/dsa/tag_ksz.c +++ b/net/dsa/tag_ksz.c @@ -24,7 +24,7 @@ static struct sk_buff *ksz_common_xmit(struct sk_buff *skb, if (skb_tailroom(skb) >= padlen + len) { /* Let dsa_slave_xmit() free skb */ - if (__skb_put_padto(skb, skb->len + padlen, false)) + if (__skb_put_padto(skb, ETH_ZLEN + len, false)) return NULL; nskb = skb; @@ -45,7 +45,7 @@ static struct sk_buff *ksz_common_xmit(struct sk_buff *skb, /* Let skb_put_padto() free nskb, and let dsa_slave_xmit() free * skb */ - if (skb_put_padto(nskb, nskb->len + padlen)) + if (skb_put_padto(nskb, ETH_ZLEN + len)) return NULL; consume_skb(skb);