Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3da947b2 authored by Sasha Levin's avatar Sasha Levin Committed by David S. Miller
Browse files

ieee802154: verify packet size before trying to allocate it 



Currently when sending data over datagram, the send function will attempt to
allocate any size passed on from the userspace.

We should make sure that this size is checked and limited. We'll limit it
to the MTU of the device, which is checked later anyway.

Signed-off-by: default avatarSasha Levin <levinsasha928@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9e85a6f9

net/ieee802154/dgram.c

+6 −6
Original line number Diff line number Diff line
@@ -230,6 +230,12 @@ static int dgram_sendmsg(struct kiocb *iocb, struct sock *sk, 
	mtu = dev->mtu;

	pr_debug("name = %s, mtu = %u\n", dev->name, mtu);



	if (size > mtu) {

		pr_debug("size = %Zu, mtu = %u\n", size, mtu);

		err = -EINVAL;

		goto out_dev;

	}



	hlen = LL_RESERVED_SPACE(dev);

	tlen = dev->needed_tailroom;

	skb = sock_alloc_send_skb(sk, hlen + tlen + size,
@@ -258,12 +264,6 @@ static int dgram_sendmsg(struct kiocb *iocb, struct sock *sk, 
	if (err < 0)

		goto out_skb;



	if (size > mtu) {

		pr_debug("size = %Zu, mtu = %u\n", size, mtu);

		err = -EINVAL;

		goto out_skb;

	}



	skb->dev = dev;

	skb->sk  = sk;

	skb->protocol = htons(ETH_P_IEEE802154);