mirror of
https://git.proxmox.com/git/mirror_ubuntu-kernels.git
synced 2025-11-18 19:25:43 +00:00
Cited commits passed a size to alloc_skb that was only big enough for the actual packet contents, but the following skb_put + memcpy writes the whole struct efx_loopback_payload including leading and trailing padding bytes (which are then stripped off with skb_pull/skb_trim). This could cause an skb_over_panic, although in practice we get saved by kmalloc_size_roundup. Pass the entire size we use, instead of the size of the final packet. Reported-by: Andy Moreton <andy.moreton@amd.com> Fixes: |
||
|---|---|---|
| .. | ||
| bitfield.h | ||
| efx.c | ||
| efx.h | ||
| enum.h | ||
| ethtool.c | ||
| falcon_boards.c | ||
| falcon.c | ||
| farch_regs.h | ||
| farch.c | ||
| filter.h | ||
| io.h | ||
| Kconfig | ||
| Makefile | ||
| mdio_10g.c | ||
| mdio_10g.h | ||
| mtd.c | ||
| net_driver.h | ||
| nic.c | ||
| nic.h | ||
| phy.h | ||
| qt202x_phy.c | ||
| rx.c | ||
| selftest.c | ||
| selftest.h | ||
| tenxpress.c | ||
| tx.c | ||
| tx.h | ||
| txc43128_phy.c | ||
| workarounds.h | ||