]> git.apps.os.sepia.ceph.com Git - ceph-client.git/commit
Merge patch series "can: populate ndo_change_mtu() to prevent buffer overflow"
authorMarc Kleine-Budde <mkl@pengutronix.de>
Fri, 19 Sep 2025 17:03:04 +0000 (19:03 +0200)
committerMarc Kleine-Budde <mkl@pengutronix.de>
Fri, 19 Sep 2025 17:03:04 +0000 (19:03 +0200)
commita3ed215cb2147e98981de5321fd1b1d0e3dceb1c
tree8923133766c3ea2091b46a8f4d7b07209e51a94b
parent5cff263606a10102a0ea19ff579eaa18fd5577ad
parent17c8d794527f01def0d1c8b7dc2d7b8d34fed0e6
Merge patch series "can: populate ndo_change_mtu() to prevent buffer overflow"

Vincent Mailhol <mailhol@kernel.org> says:

Four drivers, namely etas_es58x, hi311x, sun4i_can and mcba_usb forgot
to populate their net_device_ops->ndo_change_mtu(). Because of that,
the user is free to configure any MTU on these interfaces.

This can be abused by an attacker who could craft some skbs and send
them through PF_PACKET to perform a buffer overflow of up to 247 bytes
in each of these drivers.

This series contains four patches, one for each of the drivers, to add
the missing ndo_change_mtu() callback. The descriptions contain
detailed explanations of how the buffer overflow could be triggered.

Link: https://patch.msgid.link/20250918-can-fix-mtu-v1-0-0d1cada9393b@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>