diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2023-03-03 07:25:09 +0100 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2023-03-03 07:25:09 +0100 |
| commit | ad93bab6b8d3bfeae4a0158eaabd61bb0b2fbb79 (patch) | |
| tree | f28e38a3c71131cd4a48bb10328a65a54904b38d /drivers | |
| parent | net: caif: Fix use-after-free in cfusbl_device_notify() (diff) | |
| parent | ieee802154: Prevent user from crashing the host (diff) | |
| download | linux-ad93bab6b8d3bfeae4a0158eaabd61bb0b2fbb79.tar.xz linux-ad93bab6b8d3bfeae4a0158eaabd61bb0b2fbb79.zip | |
Merge tag 'ieee802154-for-net-2023-03-02' of git://git.kernel.org/pub/scm/linux/kernel/git/wpan/wpan
Stefan Schmidt says:
====================
ieee802154 for net 2023-03-02
Two small fixes this time.
Alexander Aring fixed a potential negative array access in the ca8210
driver.
Miquel Raynal fixed a crash that could have been triggered through
the extended netlink API for 802154. This only came in this merge window.
Found by syzkaller.
* tag 'ieee802154-for-net-2023-03-02' of git://git.kernel.org/pub/scm/linux/kernel/git/wpan/wpan:
ieee802154: Prevent user from crashing the host
ca8210: fix mac_len negative array access
====================
Link: https://lore.kernel.org/r/20230302153032.1312755-1-stefan@datenfreihafen.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/ieee802154/ca8210.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c index e1a569b99e4a..0b0c6c0764fe 100644 --- a/drivers/net/ieee802154/ca8210.c +++ b/drivers/net/ieee802154/ca8210.c @@ -1913,6 +1913,8 @@ static int ca8210_skb_tx( * packet */ mac_len = ieee802154_hdr_peek_addrs(skb, &header); + if (mac_len < 0) + return mac_len; secspec.security_level = header.sec.level; secspec.key_id_mode = header.sec.key_id_mode; |