superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

net: hsr: fix potential OOB access in supervision frame handling 

Ensure the entire TLV header is linearized before access by adding
sizeof(struct hsr_sup_tlv) to the pskb_may_pull() calls. Without this,
a truncated frame could cause an out-of-bounds access.

Fixes: eafaa88b3e ("net: hsr: Add support for redbox supervision frames")
Signed-off-by: Luka Gejak <luka.gejak@linux.dev>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Link: https://patch.msgid.link/20260523130330.61880-1-luka.gejak@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
master
Luka Gejak 2026-05-23 15:03:30 +02:00 committed by Jakub Kicinski
parent 2156a29aec
commit f229426072
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/hsr/hsr_forward.c
View File

@ -84,7 +84,7 @@ static bool is_supervision_frame(struct hsr_priv *hsr, struct sk_buff *skb)
/* Get next tlv */ /* Get next tlv */
total_length += hsr_sup_tag->tlv.HSR_TLV_length; total_length += hsr_sup_tag->tlv.HSR_TLV_length;
if (!pskb_may_pull(skb, total_length)) if (!pskb_may_pull(skb, total_length + sizeof(struct hsr_sup_tlv)))
return false; return false;
skb_pull(skb, total_length); skb_pull(skb, total_length);
hsr_sup_tlv = (struct hsr_sup_tlv *)skb->data; hsr_sup_tlv = (struct hsr_sup_tlv *)skb->data;
@ -100,7 +100,7 @@ static bool is_supervision_frame(struct hsr_priv *hsr, struct sk_buff *skb)
/* make sure another tlv follows */ /* make sure another tlv follows */
total_length += sizeof(struct hsr_sup_tlv) + hsr_sup_tlv->HSR_TLV_length; total_length += sizeof(struct hsr_sup_tlv) + hsr_sup_tlv->HSR_TLV_length;
if (!pskb_may_pull(skb, total_length)) if (!pskb_may_pull(skb, total_length + sizeof(struct hsr_sup_tlv)))
return false; return false;
/* get next tlv */ /* get next tlv */