Patch "netrom: fix info-leak in nr_write_internal()" has been added to the 6.3-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    netrom: fix info-leak in nr_write_internal()

to the 6.3-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netrom-fix-info-leak-in-nr_write_internal.patch
and it can be found in the queue-6.3 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 1920c9760fbd6678af74705297094341a5f0a09b
Author: Eric Dumazet <edumazet@xxxxxxxxxx>
Date:   Wed May 24 14:14:56 2023 +0000

    netrom: fix info-leak in nr_write_internal()
    
    [ Upstream commit 31642e7089df8fd3f54ca7843f7ee2952978cad1 ]
    
    Simon Kapadia reported the following issue:
    
    <quote>
    
    The Online Amateur Radio Community (OARC) has recently been experimenting
    with building a nationwide packet network in the UK.
    As part of our experimentation, we have been testing out packet on 300bps HF,
    and playing with net/rom.  For HF packet at this baud rate you really need
    to make sure that your MTU is relatively low; AX.25 suggests a PACLEN of 60,
    and a net/rom PACLEN of 40 to go with that.
    However the Linux net/rom support didn't work with a low PACLEN;
    the mkiss module would truncate packets if you set the PACLEN below about 200 or so, e.g.:
    
    Apr 19 14:00:51 radio kernel: [12985.747310] mkiss: ax1: truncating oversized transmit packet!
    
    This didn't make any sense to me (if the packets are smaller why would they
    be truncated?) so I started investigating.
    I looked at the packets using ethereal, and found that many were just huge
    compared to what I would expect.
    A simple net/rom connection request packet had the request and then a bunch
    of what appeared to be random data following it:
    
    </quote>
    
    Simon provided a patch that I slightly revised:
    Not only we must not use skb_tailroom(), we also do
    not want to count NR_NETWORK_LEN twice.
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Co-Developed-by: Simon Kapadia <szymon@xxxxxxxxxx>
    Signed-off-by: Simon Kapadia <szymon@xxxxxxxxxx>
    Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx>
    Tested-by: Simon Kapadia <szymon@xxxxxxxxxx>
    Reviewed-by: Simon Horman <simon.horman@xxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230524141456.1045467-1-edumazet@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/netrom/nr_subr.c b/net/netrom/nr_subr.c
index 3f99b432ea707..e2d2af924cff4 100644
--- a/net/netrom/nr_subr.c
+++ b/net/netrom/nr_subr.c
@@ -123,7 +123,7 @@ void nr_write_internal(struct sock *sk, int frametype)
 	unsigned char  *dptr;
 	int len, timeout;
 
-	len = NR_NETWORK_LEN + NR_TRANSPORT_LEN;
+	len = NR_TRANSPORT_LEN;
 
 	switch (frametype & 0x0F) {
 	case NR_CONNREQ:
@@ -141,7 +141,8 @@ void nr_write_internal(struct sock *sk, int frametype)
 		return;
 	}
 
-	if ((skb = alloc_skb(len, GFP_ATOMIC)) == NULL)
+	skb = alloc_skb(NR_NETWORK_LEN + len, GFP_ATOMIC);
+	if (!skb)
 		return;
 
 	/*
@@ -149,7 +150,7 @@ void nr_write_internal(struct sock *sk, int frametype)
 	 */
 	skb_reserve(skb, NR_NETWORK_LEN);
 
-	dptr = skb_put(skb, skb_tailroom(skb));
+	dptr = skb_put(skb, len);
 
 	switch (frametype & 0x0F) {
 	case NR_CONNREQ:



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux