From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj2-f43.google.com (mail-pj2-f43.google.com [74.125.227.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B4EC443B483 for ; Mon, 21 Sep 2026 07:42:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.227.171 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789976527; cv=none; b=vAeMyUkc5XHiF/pZ7rpw1O5nYnaxiej61mOKQfCrrf3DL2STt5gKt7nv5zJ4teD0ePBM3EzSLSbgvWu/CpO8iNLf+/dgJGNRnul3Zwpmg0JIs5rcL3vTW3w90wD9cwN+80GgnRqmI3i7eFkjbJxLwLeTO90AHz64hwXaoBz7Okc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789976527; c=relaxed/simple; bh=vSpK+C5pyaQ2+gljxZXl3+/lbaSVGdNsU+FgzLAv1qY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GkEWW7jkKG4lhQtjCVX4wUEfjpKyCcMsvBQwu4/u4wZJZZDOWT60DXTzQhgrq6r8oTUr6bFxDQBXlBxF0FyJ78rNHQc5rHjKO6qJF93EH9z0561NGlL0zqRvcf3l5jyaNp09J4Uv2oaorVq3e3Perx9MPooPyzB1yabnN2s/Mok= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=cYXpj7gZ; arc=none smtp.client-ip=74.125.227.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="cYXpj7gZ" Received: by mail-pj2-f43.google.com with SMTP id 98e67ed59e1d1-396ccda24a3so1973801a91.0 for ; Mon, 21 Sep 2026 00:42:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789976525; x=1790581325; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=VLvaiOprHNCFNGuXuFEkMmn5a+uIlIxvauRxRVWqnRw=; b=cYXpj7gZQRSxtdR/24KVbN2BjcD4bF37zaSmLFblHnNuyn7rZRnhdcILqT8TKbFV9/ DJLT4IxnHJYql8/DbTrzprie5XH3eY2hn242vQp5SkGIGA/mSyKiiWd3fmxyqz6wiGvs YyC7/xfaX0BL8zo+nvhksg+tMNFK36zEH5hjWarmuVwagrQOBm5aoGGnHWNDV7tFTTYm ivM4G2AKRNvbDAwJVvwSEdS6VahR2Be0bSpDKyzO5dk1SVzKdh+vfAXW8wgLrrQTP6O5 VFpwy9/7wRVCxz9O2BvItqq0ptC6DD/MD68iHfsMbqtnKMgZyeGo8xc3ap8lXuaNDDEw jntw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789976525; x=1790581325; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=VLvaiOprHNCFNGuXuFEkMmn5a+uIlIxvauRxRVWqnRw=; b=GdSbgDrrOZIo+I3w2q+XO3Po/4sRQI1u07ljWjMV/2NzFTzifyr5bjguc8FrnWdsbS a+pG3ahAeuPB8A5t/dOgwoBEB2q0DXZmrSFI2alTszLkTa/layePu15zL5T+o1l4U5RR tSeS8uw9MpUzLP+d68AgfRfKEC07OAVvECtKU5GzsYRs8EyhIudsKQOmzQ99PVfgabRO GrHIiCDButn+LjRdIrF7B5RKijOo3cKcoD+FEmgF9LbimwL6Jh48c0o8ukn7/XtfHnza eQFmFpBnXBfqPMMlPS3R0WAg2umjxf4nq9W9i5CmVO1BTjTRSsZsHe7OWOk/ehvdpca9 0Spw== X-Forwarded-Encrypted: i=1; AKwUvBzq0euQ+dFe8RPkUX8WpZZsgzv4jixAt6wGbNJtZP5yRVmIQtLrCzYU99vyxQx3lx01iCLpufjsXz+jF0M=@vger.kernel.org X-Gm-Message-State: AFuF++muyeo0UWMEo6Q4b9HToFH72x5nXa0eSaNIFG2poYQ8GknNodkm TAAGvTccwe2NIhCKP8VMOoTq612P0Jn+YyKxJ0V+PKlfJi6Zf/CCa9b3 X-Gm-Gg: AYBFou2nR7cxlrAqvy+JLyAcSrX4Un8GNrMJILfVv/BgLpIIbQMfxgItVO6hxswhSRf xFqsMb2yyoFAFd9nPl9f8XbKV4MFu06XLX/1CW1IL3TdjoRxsi/wqwwaxWESuENZFB/RjFFwWCX RtN9M3hNSl4I5+b5QT2ALQnXoiQfgtxifTi8xUfs0vfwbjLlg4OfA7MPScMDE0xauqQ4eS0wBcf vWUcoqSHIzqrCFQzajuCWHvPPd6KKKqPpbjpy5wEH2c8I0qah12CGZcyeRngjlppeuZuKHAnSL8 bMnunbXVxdifdlotEpaYQ5IytuQOsLRdcvZ2zED7icL5Sq0Q8Oh69K7SmGID8pEv1HF088h8Dsy Cfw5Xrcr6ZaQklKSD89o5YT7r19+0UiL5uztIONMG0BU7ay4Kp6juCVNYaAs25FNTF/Ghzf/Qxt vmGELERzBaruy0sDsIhYYKj624NnuxZv9nBj92ffBfLcLjF+5spfWuEx/2/rsxqTU9BOi2S+FLH 3+jCESs5Drwm8e71n/AJAhm5T7tnY/CTo002HsAH221THuqsYfjYRua72vC1HsgruDfecCnIgDS hDzN6jSPlg== X-Received: by 2002:a17:90b:4a03:b0:36d:9e0b:3801 with SMTP id 98e67ed59e1d1-39e54d38c48mr20398806a91.8.1789976525034; Mon, 21 Sep 2026 00:42:05 -0700 (PDT) Received: from phui-2.c.googlers.com.com (78.123.83.34.bc.googleusercontent.com. [34.83.123.78]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39e6c6dd585sm12396602a91.0.2026.09.21.00.42.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 21 Sep 2026 00:42:04 -0700 (PDT) From: Hui Peng To: Alexander Aring , Miquel Raynal , Stefan Schmidt Cc: linux-wpan@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Hui Peng , stable@vger.kernel.org Subject: [PATCH net v2 2/2] mac802154: rx: ensure tailroom before appending CRC Date: Mon, 21 Sep 2026 07:42:02 +0000 Message-ID: <20260921074202.2289040-2-benquike@gmail.com> X-Mailer: git-send-email 2.55.0.1082.g2b9226bbc0-goog In-Reply-To: <20260919213636.3316565-1-benquike@gmail.com> References: <20260919213636.3316565-1-benquike@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit When IEEE802154_HW_RX_OMIT_CKSUM is set, ieee802154_rx() appends a 2-byte calculated CRC via skb_put(skb, 2) without checking whether the driver allocated sufficient tailroom in the received skb, triggering skb_over_panic when skb_tailroom(skb) < 2: skbuff: skb_over_panic: text:ffffffffb6e61896 len:386 put:2 kernel BUG at net/core/skbuff.c:214! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI RIP: 0010:skb_panic+0x170/0x172 Call Trace: skb_put.cold+0x23/0x23 ieee802154_rx+0xb26/0x1d30 ieee802154_tasklet_handler+0xa9/0xd0 tasklet_action_common+0x2ff/0x850 handle_softirqs+0x188/0x4e0 Ensure at least 2 bytes of tailroom are available via pskb_expand_head() before calling skb_put(). Tested in QEMU with KASAN by injecting a zero-tailroom skb into ieee802154_rx() with IEEE802154_HW_RX_OMIT_CKSUM set. Fixes: b7889497d306 ("mac802154: rx: simplify crc receive handling") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Hui Peng --- Changes in v2: - Split from the beacon/mac_cmd skb leak fix into patch 2/2. - Dropped the redundant skb->len < 2 check as noted by Miquel Raynal. - Only call pskb_expand_head() when skb_tailroom(skb) < 2. net/mac802154/rx.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c index ad602d2..6aa5920 100644 --- a/net/mac802154/rx.c +++ b/net/mac802154/rx.c @@ -487,6 +487,9 @@ void ieee802154_rx(struct ieee802154_local *local, struct sk_buff *skb) * solution because the monitor needs a crc here. */ if (local->hw.flags & IEEE802154_HW_RX_OMIT_CKSUM) { + if (skb_tailroom(skb) < 2 && + pskb_expand_head(skb, 0, 2, GFP_ATOMIC)) + goto free_skb; crc = crc_ccitt(0, skb->data, skb->len); put_unaligned_le16(crc, skb_put(skb, 2)); } -- 2.47.3