In cc2520_tx(), when priv->promiscuous is enabled, skb_put(skb, 2) is
called unconditionally to append the 2-byte software CRC without checking
whether the skb has at least 2 bytes of tailroom, triggering
skb_over_panic when skb_tailroom(skb) < 2:
skbuff: skb_over_panic: text:ffffffffc080071a len:386 put:2
kernel BUG at net/core/skbuff.c:214!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
RIP: 0010:skb_panic+0x170/0x172
Call Trace:
<TASK>
skb_put.cold+0x23/0x23
cc2520_tx.constprop.0.isra.0+0x8a/0x1d0
Ensure at least 2 bytes of tailroom via pskb_expand_head() before calling
skb_put(skb, 2).
Tested in QEMU with KASAN enabled by passing a zero-tailroom skb to
cc2520_tx() with promiscuous mode enabled.
Fixes: 59869ebfe7a7 ("ieee802154: cc2520: Check CRC & add promiscuous")
Cc: [email protected]
Assisted-by: LLM
Signed-off-by: Hui Peng <[email protected]>
---
Changes in v2:
- Split the cc2520 and mcr20a fixes into four single-issue patches
(1/4..4/4) and documented each change in its own commit message as
requested by Miquel Raynal.
drivers/net/ieee802154/cc2520.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ieee802154/cc2520.c b/drivers/net/ieee802154/cc2520.c
index abfcfe0..5454872 100644
--- a/drivers/net/ieee802154/cc2520.c
+++ b/drivers/net/ieee802154/cc2520.c
@@ -482,8 +482,14 @@ cc2520_tx(struct ieee802154_hw *hw, struct sk_buff *skb)
* values on RX. This means we need to manually add the CRC on TX.
*/
if (priv->promiscuous) {
- u16 crc = crc_ccitt(0, skb->data, skb->len);
+ u16 crc;
+ if (skb_tailroom(skb) < 2 &&
+ pskb_expand_head(skb, 0, 2, GFP_KERNEL)) {
+ rc = -ENOMEM;
+ goto err_tx;
+ }
+ crc = crc_ccitt(0, skb->data, skb->len);
put_unaligned_le16(crc, skb_put(skb, 2));
pkt_len = skb->len;
} else {
--
2.47.3
