> > A quick search for ethhdr in drivers/net/ethernet shows, for > > instance, > > bnx2x_select_queue casting skb->data to an ethernet header. Reading > > nonsense in that particular function is quite safe and given the > > skbuff layout (skb_shared_info) code will never read beyond an > > allocated region. But that was just the first occurrence I found. > > efx_tso_check_protocol is another example.
So would always allocating that much space be a good mitigation in general, and perhaps then making the logic check validate() IFF CAP_SYS_RAWIO is not set. A user with CAP_SYS_RAWIO already has the power to control the device by banging registers so the check is not a security loss. Alan
