net: qrtr: fix len of skb_put_padto in qrtr_node_enqueue

Carl Huang · davem330 · commit ce57785bf91b · 2020-01-05T14:46:05.000-08:00
The len used for skb_put_padto is wrong, it need to add len of hdr.

In qrtr_node_enqueue, local variable size_t len is assign with
skb-&gt;len, then skb_push(skb, sizeof(*hdr)) will add skb-&gt;len with
sizeof(*hdr), so local variable size_t len is not same with skb-&gt;len
after skb_push(skb, sizeof(*hdr)).

Then the purpose of skb_put_padto(skb, ALIGN(len, 4)) is to add add
pad to the end of the skb's data if skb-&gt;len is not aligned to 4, but
unfortunately it use len instead of skb-&gt;len, at this line, skb-&gt;len
is 32 bytes(sizeof(*hdr)) more than len, for example, len is 3 bytes,
then skb-&gt;len is 35 bytes(3 + 32), and ALIGN(len, 4) is 4 bytes, so
__skb_put_padto will do nothing after check size(35) &lt; len(4), the
correct value should be 36(sizeof(*hdr) + ALIGN(len, 4) = 32 + 4),
then __skb_put_padto will pass check size(35) &lt; len(36) and add 1 byte
to the end of skb's data, then logic is correct.

function of skb_push:
void *skb_push(struct sk_buff *skb, unsigned int len)
{
	skb-&gt;data -= len;
	skb-&gt;len  += len;
	if (unlikely(skb-&gt;data &lt; skb-&gt;head))
		skb_under_panic(skb, len, __builtin_return_address(0));
	return skb-&gt;data;
}

function of skb_put_padto
static inline int skb_put_padto(struct sk_buff *skb, unsigned int len)
{
	return __skb_put_padto(skb, len, true);
}

function of __skb_put_padto
static inline int __skb_put_padto(struct sk_buff *skb, unsigned int len,
				  bool free_on_error)
{
	unsigned int size = skb-&gt;len;

	if (unlikely(size &lt; len)) {
		len -= size;
		if (__skb_pad(skb, len, free_on_error))
			return -ENOMEM;
		__skb_put(skb, len);
	}
	return 0;
}

Signed-off-by: Carl Huang &lt;cjhuang@codeaurora.org&gt;
Signed-off-by: Wen Gong &lt;wgong@codeaurora.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
@@ -196,7 +196,7 @@ static int qrtr_node_enqueue(struct qrtr_node *node, struct sk_buff *skb,
 	hdr->size = cpu_to_le32(len);
 	hdr->confirm_rx = 0;
 
-	skb_put_padto(skb, ALIGN(len, 4));
+	skb_put_padto(skb, ALIGN(len, 4) + sizeof(*hdr));
 
 	mutex_lock(&node->ep_lock);
 	if (node->ep)
