diff options
| author | Christophe JAILLET <christophe.jaillet@wanadoo.fr> | 2019-08-26 22:02:09 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-09-07 16:46:28 +0300 |
| commit | b82573fdbef809803d06295f318f7ad1a2c5ceb9 (patch) | |
| tree | 9333d1b98f4f54ab424f6807cc41506669e989c0 /drivers/net | |
| parent | 0c04eb72d332ef6e12c3ecb0c638359e65ad29d9 (diff) | |
| download | linux-b82573fdbef809803d06295f318f7ad1a2c5ceb9.tar.xz | |
net/hamradio/6pack: Fix the size of a sk_buff used in 'sp_bump()'
We 'allocate' 'count' bytes here. In fact, 'dev_alloc_skb' already add some
extra space for padding, so a bit more is allocated.
However, we use 1 byte for the KISS command, then copy 'count' bytes, so
count+1 bytes.
Explicitly allocate and use 1 more byte to be safe.
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/hamradio/6pack.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c index 331c16d30d5d..23281aeeb222 100644 --- a/drivers/net/hamradio/6pack.c +++ b/drivers/net/hamradio/6pack.c @@ -344,10 +344,10 @@ static void sp_bump(struct sixpack *sp, char cmd) sp->dev->stats.rx_bytes += count; - if ((skb = dev_alloc_skb(count)) == NULL) + if ((skb = dev_alloc_skb(count + 1)) == NULL) goto out_mem; - ptr = skb_put(skb, count); + ptr = skb_put(skb, count + 1); *ptr++ = cmd; /* KISS command */ memcpy(ptr, sp->cooked_buf + 1, count); |