diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2023-03-03 07:25:09 +0100 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2023-03-03 07:25:09 +0100 |
| commit | ad93bab6b8d3bfeae4a0158eaabd61bb0b2fbb79 (patch) | |
| tree | f28e38a3c71131cd4a48bb10328a65a54904b38d | |
| parent | net: caif: Fix use-after-free in cfusbl_device_notify() (diff) | |
| parent | ieee802154: Prevent user from crashing the host (diff) | |
| download | linux-ad93bab6b8d3bfeae4a0158eaabd61bb0b2fbb79.tar.xz linux-ad93bab6b8d3bfeae4a0158eaabd61bb0b2fbb79.zip | |
Merge tag 'ieee802154-for-net-2023-03-02' of git://git.kernel.org/pub/scm/linux/kernel/git/wpan/wpan
Stefan Schmidt says:
====================
ieee802154 for net 2023-03-02
Two small fixes this time.
Alexander Aring fixed a potential negative array access in the ca8210
driver.
Miquel Raynal fixed a crash that could have been triggered through
the extended netlink API for 802154. This only came in this merge window.
Found by syzkaller.
* tag 'ieee802154-for-net-2023-03-02' of git://git.kernel.org/pub/scm/linux/kernel/git/wpan/wpan:
ieee802154: Prevent user from crashing the host
ca8210: fix mac_len negative array access
====================
Link: https://lore.kernel.org/r/20230302153032.1312755-1-stefan@datenfreihafen.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | drivers/net/ieee802154/ca8210.c | 2 | ||||
| -rw-r--r-- | net/ieee802154/nl802154.c | 2 |
2 files changed, 3 insertions, 1 deletions
diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c index e1a569b99e4a..0b0c6c0764fe 100644 --- a/drivers/net/ieee802154/ca8210.c +++ b/drivers/net/ieee802154/ca8210.c @@ -1913,6 +1913,8 @@ static int ca8210_skb_tx( * packet */ mac_len = ieee802154_hdr_peek_addrs(skb, &header); + if (mac_len < 0) + return mac_len; secspec.security_level = header.sec.level; secspec.key_id_mode = header.sec.key_id_mode; diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c index 2215f576ee37..d8f4379d4fa6 100644 --- a/net/ieee802154/nl802154.c +++ b/net/ieee802154/nl802154.c @@ -1412,7 +1412,7 @@ static int nl802154_trigger_scan(struct sk_buff *skb, struct genl_info *info) return -EOPNOTSUPP; } - if (!nla_get_u8(info->attrs[NL802154_ATTR_SCAN_TYPE])) { + if (!info->attrs[NL802154_ATTR_SCAN_TYPE]) { NL_SET_ERR_MSG(info->extack, "Malformed request, missing scan type"); return -EINVAL; } |