@@ -1925,6 +1925,11 @@ static netdev_tx_t mpi_start_xmit(struct sk_buff *skb,
airo_print_err(dev->name, "%s: skb == NULL!",__func__);
return NETDEV_TX_OK;
}
+ if (skb->len < ETH_ZLEN) {
+ if (skb_padto(skb, ETH_ZLEN))
+ return NETDEV_TX_OK;
+ }
+
npacks = skb_queue_len (&ai->txq);
if (npacks >= MAXTXQ - 1) {
@@ -1975,8 +1980,7 @@ static int mpi_send_packet (struct net_device *dev)
return 0;
}
- /* check min length*/
- len = ETH_ZLEN < skb->len ? skb->len : ETH_ZLEN;
+ len = skb->len;
buffer = skb->data;
ai->txfids[0].tx_desc.offset = 0;
The problem is that we always copy a minimum of ETH_ZLEN (60) bytes from skb->data even when skb->len is less than ETH_ZLEN so it leads to a read overflow. The fix for is to pad skb->data with zeroes so that it's never less than ETH_ZLEN bytes. c: <stable@vger.kernel.org> Reported-by: Hu Jiahui <kirin.say@gmail.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- Resending to the public lists so that it can go through the normal review process. My other concern with this driver is why is the ->max_mtu 2400 when it looks like we are allocating PKTSIZE (1840) byte buffers to hold it in mpi_map_card()? I don't fully understand the code but that seems like it could be a buffer overflow as well. I'm not sure what the appropriate fix is for that. drivers/net/wireless/cisco/airo.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)