From nobody Fri Dec 19 12:51:49 2025 Received: from forwardcorp1a.mail.yandex.net (forwardcorp1a.mail.yandex.net [178.154.239.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3F6373148DA; Wed, 5 Nov 2025 12:27:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=178.154.239.72 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762345667; cv=none; b=I9GVy1A3e1IOD2PT9Aqg5uMiMETvkNw7QQsmXF7KQQ5SCfHjSKD9/X1ZTtnIAKVG66lwSji64yJfy+X6vZlOMGQ6NeEaI2cbu3hRBvbPDNmtu4HaTJIYlt7HYUVWuV0nwpQcSACXBOZLvfnjZBaXfM11Cnv05odokl5OPyeb54E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762345667; c=relaxed/simple; bh=aDmhW/SCqJy4FgWJbCC+D+B6edbfpUj7YKK4HhZDGMU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=py3qrmcWJ4O+kayc+NcSJ+hs78Z+mPVUgFTDQhYUk3kOqxOInvi1q6RRijgNqob5Ab+YNmrw8LiAFVm+OBVVoQsW/ASUW/ma8CLNK0rQmvHf6c9JpUC6jQdA4gHlBd3PzoVMC6HYznHN2fG7CemcMfB410VqjuHIlV+395pq+BY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex-team.ru; spf=pass smtp.mailfrom=yandex-team.ru; dkim=pass (1024-bit key) header.d=yandex-team.ru header.i=@yandex-team.ru header.b=GK4T82Md; arc=none smtp.client-ip=178.154.239.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex-team.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=yandex-team.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=yandex-team.ru header.i=@yandex-team.ru header.b="GK4T82Md" Received: from mail-nwsmtp-smtp-corp-main-34.sas.yp-c.yandex.net (mail-nwsmtp-smtp-corp-main-34.sas.yp-c.yandex.net [IPv6:2a02:6b8:c21:2d8b:0:640:7d49:0]) by forwardcorp1a.mail.yandex.net (Yandex) with ESMTPS id C4FE0C01E6; Wed, 05 Nov 2025 15:25:54 +0300 (MSK) Received: from i111667286.ld.yandex.ru (unknown [2a02:6bf:8080:673::1:31]) by mail-nwsmtp-smtp-corp-main-34.sas.yp-c.yandex.net (smtpcorp/Yandex) with ESMTPSA id oPkVj10F2uQ0-f1IIpPFi; Wed, 05 Nov 2025 15:25:54 +0300 X-Yandex-Fwd: 1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex-team.ru; s=default; t=1762345554; bh=MpDXcupdB1+HpjGFUEV7oRUOAUpuEPaulnCwN+XtQsM=; h=Message-ID:Date:Cc:Subject:To:From; b=GK4T82MdqXVbkUB9Wb5FXj4+WOmkbe+MgAMoRAR+hcLpC3TIaUjnaecIEGnoVvjRX Hvtw6Q+yodwkIPVN1v9Wq17aI8D9ZEFTPVq4O9CG1C4jtMCWySf5WV5wEExiQpUTiQ DitsS4ePZgZiX4EZChfFGfFjJ6TZP14j72JxnxHM= Authentication-Results: mail-nwsmtp-smtp-corp-main-34.sas.yp-c.yandex.net; dkim=pass header.i=@yandex-team.ru From: Andrey Troshin To: stable@vger.kernel.org, Greg Kroah-Hartman Cc: Andrey Troshin , Steve French , linux-cifs@vger.kernel.org, samba-technical@lists.samba.org, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org Subject: [PATCH 5.10] net: dlink: handle copy_thresh allocation failure Date: Wed, 5 Nov 2025 15:25:50 +0300 Message-ID: <20251105122550.1497-1-drtrosh@yandex-team.ru> X-Mailer: git-send-email 2.51.0.windows.2 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Yeounsu Moon [ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ] The driver did not handle failure of `netdev_alloc_skb_ip_align()`. If the allocation failed, dereferencing `skb->protocol` could lead to a NULL pointer dereference. This patch tries to allocate `skb`. If the allocation fails, it falls back to the normal path. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Jakub Kicinski Tested-on: D-Link DGE-550T Rev-A3 Signed-off-by: Yeounsu Moon Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin [Andrey Troshin: fixe merge conflicts] Signed-off-by: Andrey Troshin --- Backport fix for CVE-2025-40053 Link: https://nvd.nist.gov/vuln/detail/CVE-2025-40053 --- drivers/net/ethernet/dlink/dl2k.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink= /dl2k.c index af1e96e0209f..0af58c4dcebc 100644 --- a/drivers/net/ethernet/dlink/dl2k.c +++ b/drivers/net/ethernet/dlink/dl2k.c @@ -957,15 +957,18 @@ receive_packet (struct net_device *dev) } else { struct sk_buff *skb; =20 + skb =3D NULL; /* Small skbuffs for short packets */ - if (pkt_len > copy_thresh) { + if (pkt_len <=3D copy_thresh) + skb =3D netdev_alloc_skb_ip_align(dev, pkt_len); + if (!skb) { dma_unmap_single(&np->pdev->dev, desc_to_dma(desc), np->rx_buf_sz, DMA_FROM_DEVICE); skb_put (skb =3D np->rx_skbuff[entry], pkt_len); np->rx_skbuff[entry] =3D NULL; - } else if ((skb =3D netdev_alloc_skb_ip_align(dev, pkt_len))) { + } else { dma_sync_single_for_cpu(&np->pdev->dev, desc_to_dma(desc), np->rx_buf_sz, --=20 2.34.1