From: Randy MacLeod Randy.MacLeod@windriver.com
This is my first commit to -stable so I'm going to carefully explain what I've done. I work on the Yocto Project and I have done some work on the Linux network stack a long time ago so I'm not quite a complete newbie.
I took the commit found here: https://lore.kernel.org/stable/20240527185645.658299380@linuxfoundation.org/
and backported as per my commit log: Based on above commit but simplified since pskb_may_pull_reason() does not exist until 6.1.
I also trimmed the original commit log of the "Tested by dropwatch" section as well as the full stack trace since that may have changed in 5.10/5.15 and It compiles fine for 5.10 and 5.15 but I have not tested with dropwatch since the patch is just dropping short xmit packets for bridging.
Finally, since the patch is much simpler than the original, I've removed the original patch author's SOB line.
Please let me know if any of this is not what y'all'd like to see.
Randy MacLeod (1): net: bridge: xmit: make sure we have at least eth header len bytes
net/bridge/br_device.c | 5 +++++ 1 file changed, 5 insertions(+)
base-commit: 5a8fa04b2a4de1d52be4a04690dcb52ac7998943
From: Randy MacLeod Randy.MacLeod@windriver.com
[ Upstream commit 8bd67ebb50c0145fd2ca8681ab65eb7e8cde1afc ]
Based on above commit but simplified since pskb_may_pull_reason() does not exist until 6.1.
syzbot triggered an uninit value[1] error in bridge device's xmit path by sending a short (less than ETH_HLEN bytes) skb. To fix it check if we can actually pull that amount instead of assuming.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+a63a1f6a062033cf0f40@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a63a1f6a062033cf0f40 Signed-off-by: Randy MacLeod Randy.MacLeod@windriver.com --- net/bridge/br_device.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c index d3ea9d0779fb..84e37108c6b5 100644 --- a/net/bridge/br_device.c +++ b/net/bridge/br_device.c @@ -36,6 +36,11 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev) const unsigned char *dest; u16 vid = 0;
+ if (unlikely(!pskb_may_pull(skb, ETH_HLEN))) { + kfree_skb(skb); + return NETDEV_TX_OK; + } + memset(skb->cb, 0, sizeof(struct br_input_skb_cb));
rcu_read_lock();
linux-stable-mirror@lists.linaro.org