appletalk: Fix skb allocation size in loopback case
authorDoug Brown <doug@schmorgal.com>
Fri, 12 Feb 2021 05:27:54 +0000 (21:27 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 7 Apr 2021 13:00:08 +0000 (15:00 +0200)
commitc805f215e9c587db246c20e985dda5a768bab3e7
tree6be07b5a498f883ac33a052b62af4b58d177d369
parentf2294a707f6334689a35d56d21ddafa12ca23e1a
appletalk: Fix skb allocation size in loopback case

[ Upstream commit 39935dccb21c60f9bbf1bb72d22ab6fd14ae7705 ]

If a DDP broadcast packet is sent out to a non-gateway target, it is
also looped back. There is a potential for the loopback device to have a
longer hardware header length than the original target route's device,
which can result in the skb not being created with enough room for the
loopback device's hardware header. This patch fixes the issue by
determining that a loopback will be necessary prior to allocating the
skb, and if so, ensuring the skb has enough room.

This was discovered while testing a new driver that creates a LocalTalk
network interface (LTALK_HLEN = 1). It caused an skb_under_panic.

Signed-off-by: Doug Brown <doug@schmorgal.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/appletalk/ddp.c