x25: Handle undersized/fragmented skbs
There are multiple locations in the X.25 packet layer where a skb is assumed to be of at least a certain size and that all its data is currently available at skb->data. These assumptions are not checked, hence buffer overreads may occur. Use pskb_may_pull to check these minimal size assumptions and ensure that data is available at skb->data when necessary, as well as use skb_copy_bits where needed. Signed-off-by:Matthew Daley <mattjd@gmail.com> Cc: Eric Dumazet <eric.dumazet@gmail.com> Cc: Andrew Hendry <andrew.hendry@gmail.com> Cc: stable <stable@kernel.org> Acked-by:
Andrew Hendry <andrew.hendry@gmail.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
Showing
- net/x25/af_x25.c 24 additions, 7 deletionsnet/x25/af_x25.c
- net/x25/x25_dev.c 6 additions, 0 deletionsnet/x25/x25_dev.c
- net/x25/x25_facilities.c 6 additions, 4 deletionsnet/x25/x25_facilities.c
- net/x25/x25_in.c 35 additions, 5 deletionsnet/x25/x25_in.c
- net/x25/x25_link.c 3 additions, 0 deletionsnet/x25/x25_link.c
- net/x25/x25_subr.c 13 additions, 1 deletionnet/x25/x25_subr.c
Please register or sign in to comment