In eth_get_l2_hdr_length() we return sizeof(eth_header) for any protocol other than VLAN or DVLAN. However, in the iov version of this function, if the packet is larger than the ethernet header but not large enough for both the eth_header and the vlan_header we'll end up returning the actual packet size rather than the eth_header size. Fix the "not enough data" return case.
This will only cause issues if the caller isn't already checking offsets and sizes, so this is defence-in-depth. It also in theory corrects the result for the hypothetical case of an ethernet-level protocol that allows a payload of less than 4 bytes. Cc: [email protected] Fixes: eb700029c783 ("net_pkt: Extend packet abstraction as required by e1000e functionality") Signed-off-by: Peter Maydell <[email protected]> --- include/net/eth.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/net/eth.h b/include/net/eth.h index e10684ed923..3e83f5d68c0 100644 --- a/include/net/eth.h +++ b/include/net/eth.h @@ -321,7 +321,7 @@ eth_get_l2_hdr_length_iov(const struct iovec *iov, size_t iovcnt, size_t iovoff) size_t copied = iov_to_buf(iov, iovcnt, iovoff, p, ARRAY_SIZE(p)); if (copied < ARRAY_SIZE(p)) { - return copied; + return MIN(copied, sizeof(struct eth_header)); } return eth_get_l2_hdr_length(p); -- 2.43.0
