[PATCH] atm: br2684, pppoatm: add missing pskb_may_pull() and headroom checks
From: Hui Peng <hidden>
Date: 2026-09-19 22:34:32
Also in:
lkml
Subsystem:
atm, networking [general], ppp over atm (rfc 2364), the rest · Maintainers:
Chas Williams, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Mitchell Blank Jr, Linus Torvalds
In net/atm/br2684.c and net/atm/pppoatm.c, verify packet header lengths
with pskb_may_pull() on receive and ensure sufficient skb headroom via
skb_cow_head() before skb_push() on transmit.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: LLM
Signed-off-by: Hui Peng <redacted>
---diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 05712c28386a..4e397b1a3a27 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c@@ -369,8 +369,11 @@ static int br2684_setfilt(struct atm_vcc *atmvcc, void __user * arg) * by device. */ struct br2684_dev *brdev; + struct net_device *net_dev; + read_lock(&devs_lock); - brdev = BRPRIV(br2684_find_dev(&fs.ifspec)); + net_dev = br2684_find_dev(&fs.ifspec); + brdev = net_dev ? BRPRIV(net_dev) : NULL; if (brdev == NULL || list_empty(&brdev->brvccs) || brdev->brvccs.next != brdev->brvccs.prev) /* >1 VCC */ brvcc = NULL;
@@ -392,6 +395,7 @@ packet_fails_filter(__be16 type, struct br2684_vcc *brvcc, struct sk_buff *skb) if (brvcc->filter.netmask == 0) return 0; /* no filter in place */ if (type == htons(ETH_P_IP) && + pskb_may_pull(skb, sizeof(struct iphdr)) && (((struct iphdr *)(skb->data))->daddr & brvcc->filter. netmask) == brvcc->filter.prefix) return 0;
@@ -449,7 +453,7 @@ static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb) __skb_trim(skb, skb->len - 4); /* accept packets that have "ipv[46]" in the snap header */ - if ((skb->len >= (sizeof(llc_oui_ipv4))) && + if (pskb_may_pull(skb, sizeof(llc_oui_ipv4)) && (memcmp(skb->data, llc_oui_ipv4, sizeof(llc_oui_ipv4) - BR2684_ETHERTYPE_LEN) == 0)) { if (memcmp(skb->data + 6, ethertype_ipv6,
@@ -468,7 +472,7 @@ static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb) * Note, that only 7 char is checked so frames with a valid FCS * are also accepted (but FCS is not checked of course). */ - } else if ((skb->len >= sizeof(llc_oui_pid_pad)) && + } else if (pskb_may_pull(skb, sizeof(llc_oui_pid_pad) + ETH_HLEN) && (memcmp(skb->data, llc_oui_pid_pad, 7) == 0)) { skb_pull(skb, sizeof(llc_oui_pid_pad)); skb->protocol = eth_type_trans(skb, net_dev);
@@ -479,6 +483,8 @@ static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb) if (brdev->payload == p_routed) { struct iphdr *iph; + if (!pskb_may_pull(skb, sizeof(struct iphdr))) + goto dropped; skb_reset_network_header(skb); iph = ip_hdr(skb); if (iph->version == 4)
@@ -489,6 +495,8 @@ static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb) goto error; skb->pkt_type = PACKET_HOST; } else { /* p_bridged */ + if (!pskb_may_pull(skb, BR2684_PAD_LEN + ETH_HLEN)) + goto dropped; /* first 2 chars should be 0 */ if (memcmp(skb->data, pad, BR2684_PAD_LEN) != 0) goto error;
@@ -535,6 +543,8 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg) struct atm_backend_br2684 be; int err; + if (atmvcc->user_back) + return -EINVAL; if (copy_from_user(&be, arg, sizeof be)) return -EFAULT; brvcc = kzalloc_obj(struct br2684_vcc);
diff --git a/net/atm/pppoatm.c b/net/atm/pppoatm.c
index 5214786e61d1..c3a693e20aba 100644
--- a/net/atm/pppoatm.c
+++ b/net/atm/pppoatm.c@@ -397,6 +397,8 @@ static int pppoatm_assign_vcc(struct atm_vcc *atmvcc, void __user *arg) atomic_set(&pvcc->inflight, NONE_INFLIGHT); pvcc->old_push = atmvcc->push; pvcc->old_pop = atmvcc->pop; + if (atmvcc->user_back) + return -EINVAL; pvcc->old_owner = atmvcc->owner; pvcc->old_release_cb = atmvcc->release_cb; pvcc->encaps = (enum pppoatm_encaps) be.encaps;