Commit b82573fd authored by Christophe JAILLET's avatar Christophe JAILLET Committed by David S. Miller

net/hamradio/6pack: Fix the size of a sk_buff used in 'sp_bump()'

We 'allocate' 'count' bytes here. In fact, 'dev_alloc_skb' already add some
extra space for padding, so a bit more is allocated.

However, we use 1 byte for the KISS command, then copy 'count' bytes, so
count+1 bytes.

Explicitly allocate and use 1 more byte to be safe.
Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0c04eb72
...@@ -344,10 +344,10 @@ static void sp_bump(struct sixpack *sp, char cmd) ...@@ -344,10 +344,10 @@ static void sp_bump(struct sixpack *sp, char cmd)
sp->dev->stats.rx_bytes += count; sp->dev->stats.rx_bytes += count;
if ((skb = dev_alloc_skb(count)) == NULL) if ((skb = dev_alloc_skb(count + 1)) == NULL)
goto out_mem; goto out_mem;
ptr = skb_put(skb, count); ptr = skb_put(skb, count + 1);
*ptr++ = cmd; /* KISS command */ *ptr++ = cmd; /* KISS command */
memcpy(ptr, sp->cooked_buf + 1, count); memcpy(ptr, sp->cooked_buf + 1, count);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment