summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorChristophe JAILLET <christophe.jaillet@wanadoo.fr>2019-08-26 21:02:09 +0200
committerDavid S. Miller <davem@davemloft.net>2019-09-07 15:46:28 +0200
commitb82573fdbef809803d06295f318f7ad1a2c5ceb9 (patch)
tree9333d1b98f4f54ab424f6807cc41506669e989c0
parent0c04eb72d332ef6e12c3ecb0c638359e65ad29d9 (diff)
net/hamradio/6pack: Fix the size of a sk_buff used in 'sp_bump()'
We 'allocate' 'count' bytes here. In fact, 'dev_alloc_skb' already add some extra space for padding, so a bit more is allocated. However, we use 1 byte for the KISS command, then copy 'count' bytes, so count+1 bytes. Explicitly allocate and use 1 more byte to be safe. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--drivers/net/hamradio/6pack.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 331c16d30d5d..23281aeeb222 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -344,10 +344,10 @@ static void sp_bump(struct sixpack *sp, char cmd)
sp->dev->stats.rx_bytes += count;
- if ((skb = dev_alloc_skb(count)) == NULL)
+ if ((skb = dev_alloc_skb(count + 1)) == NULL)
goto out_mem;
- ptr = skb_put(skb, count);
+ ptr = skb_put(skb, count + 1);
*ptr++ = cmd; /* KISS command */
memcpy(ptr, sp->cooked_buf + 1, count);