When IEEE802154_HW_RX_OMIT_CKSUM is set, ieee802154_rx() appends a 2-byte
calculated CRC via skb_put(skb, 2) without checking whether the driver
allocated sufficient tailroom in the received skb, triggering
skb_over_panic when skb_tailroom(skb) < 2:
skbuff: skb_over_panic: text:ffffffffb6e61896 len:386 put:2
kernel BUG at net/core/skbuff.c:214!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
RIP: 0010:skb_panic+0x170/0x172
Call Trace:
<TASK>
skb_put.cold+0x23/0x23
ieee802154_rx+0xb26/0x1d30
ieee802154_tasklet_handler+0xa9/0xd0
tasklet_action_common+0x2ff/0x850
handle_softirqs+0x188/0x4e0
Ensure at least 2 bytes of tailroom are available via pskb_expand_head()
before calling skb_put().
Tested in QEMU with KASAN by injecting a zero-tailroom skb into
ieee802154_rx() with IEEE802154_HW_RX_OMIT_CKSUM set.
Fixes: b7889497d306 ("mac802154: rx: simplify crc receive handling")
Cc: [email protected]
Assisted-by: LLM
Signed-off-by: Hui Peng <[email protected]>
---
Changes in v2:
- Split from the beacon/mac_cmd skb leak fix into patch 2/2.
- Dropped the redundant skb->len < 2 check as noted by Miquel Raynal.
- Only call pskb_expand_head() when skb_tailroom(skb) < 2.
net/mac802154/rx.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
index ad602d2..6aa5920 100644
--- a/net/mac802154/rx.c
+++ b/net/mac802154/rx.c
@@ -487,6 +487,9 @@ void ieee802154_rx(struct ieee802154_local *local, struct
sk_buff *skb)
* solution because the monitor needs a crc here.
*/
if (local->hw.flags & IEEE802154_HW_RX_OMIT_CKSUM) {
+ if (skb_tailroom(skb) < 2 &&
+ pskb_expand_head(skb, 0, 2, GFP_ATOMIC))
+ goto free_skb;
crc = crc_ccitt(0, skb->data, skb->len);
put_unaligned_le16(crc, skb_put(skb, 2));
}
--
2.47.3
