6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Greg Kroah-Hartman nr_route_frame() only checked that an incoming frame was long enough for the two network layer addresses and the time-to-live byte, and did so against skb->len without making sure the bytes were in the linear part of the skb. A valid NET/ROM network frame always carries the 5-byte transport header as well, so anything shorter than NR_NETWORK_LEN + NR_TRANSPORT_LEN (20 bytes) is malformed, whether it is for this node or in transit. Use pskb_may_pull() for that length, as suggested in review, so the header fields are also guaranteed to be linear before they are read here or later in nr_rx_frame(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Greg Kroah-Hartman [F6BVP: taken from the nr_route.c part of Greg's "netrom: do some basic forms of validation on incoming frames"; the nr_rx_frame() part is handled separately. Switched from a skb->len test to pskb_may_pull() following Simon Horman's review.] Signed-off-by: Bernard Pidoux (cherry picked from commit dc06212ff6bb781fad2b5082e3ecb7cc93336da0) Signed-off-by: Sasha Levin --- net/netrom/nr_route.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c index 9cc29ae85b06f..7f55030e4b166 100644 --- a/net/netrom/nr_route.c +++ b/net/netrom/nr_route.c @@ -755,10 +755,11 @@ int nr_route_frame(struct sk_buff *skb, ax25_cb *ax25) struct sk_buff *nskb, *oskb; /* - * Reject malformed packets early. Check that it contains at least 2 - * addresses and 1 byte more for Time-To-Live + * Reject malformed packets early. Check that it contains at least + * the network and transport headers (20 bytes), and that they are + * in the linear part of the skb. */ - if (skb->len < 2 * sizeof(ax25_address) + 1) + if (!pskb_may_pull(skb, NR_NETWORK_LEN + NR_TRANSPORT_LEN)) return 0; nr_src = (ax25_address *)(skb->data + 0); -- 2.53.0