Commit 2e9f6093 authored by Phillip Potter's avatar Phillip Potter Committed by David S. Miller
Browse files

net: hsr: check skb can contain struct hsr_ethhdr in fill_frame_info 

Check at start of fill_frame_info that the MAC header in the supplied
skb is large enough to fit a struct hsr_ethhdr, as otherwise this is
not a valid HSR frame. If it is too small, return an error which will
then cause the callers to clean up the skb. Fixes a KMSAN-found
uninit-value bug reported by syzbot at:
https://syzkaller.appspot.com/bug?id=f7e9b601f1414f814f7602a82b6619a8d80bce3f



Reported-by: default avatar <syzbot+e267bed19bfc5478fb33@syzkaller.appspotmail.com>
Signed-off-by: default avatarPhillip Potter <phil@philpotter.co.uk>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f282df03

net/hsr/hsr_forward.c

+4 −0
Original line number Diff line number Diff line
@@ -520,6 +520,10 @@ static int fill_frame_info(struct hsr_frame_info *frame, 
	struct ethhdr *ethhdr;

	__be16 proto;



	/* Check if skb contains hsr_ethhdr */

	if (skb->mac_len < sizeof(struct hsr_ethhdr))

		return -EINVAL;



	memset(frame, 0, sizeof(*frame));

	frame->is_supervision = is_supervision_frame(port->hsr, skb);

	frame->node_src = hsr_get_node(port, &hsr->node_db, skb,