Re: [PATCH v3 net] ax25: fix OOB read after address header strip in ax25_rcv()
Ashutosh Desai <[email protected]> Wed, 15 Apr 2026 22:39:13 -0700 (PDT)
| Newsgroups | org.kernel.vger.linux-hams,org.kernel.vger.linux-kernel,org.kernel.vger.netdev,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
On Wed, 15 Apr 2026 08:59:21 +0100, David Laight wrote: > Is it just worth linearising the skb on entry to all this code? Thanks for the feedback, David. skb_linearize() on entry is a nice idea for simplifying sanity checks overall, but it wouldn't fix this particular bug on its own - the issue is skb->len dropping to zero after skb_pull(), not non-linear data. We'd still need a length check regardless. pskb_may_pull(skb, 2) handles both in one call. That said, linearizing on entry to ax25_rcv() as a cleanup to simplify future checks sounds worthwhile - happy to send that as a separate net-next patch.