Received: by 2002:a6b:500f:0:0:0:0:0 with SMTP id e15csp2629349iob; Fri, 6 May 2022 07:09:42 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxpGfphL2IXTsEPEknMSTXDkRF8rrpyIVzjr8/N9LDXEmuUXVCuKTtU/SHDB1rKQNRDmDnp X-Received: by 2002:a05:6638:3012:b0:317:9a63:ecd3 with SMTP id r18-20020a056638301200b003179a63ecd3mr1648878jak.210.1651846182638; Fri, 06 May 2022 07:09:42 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1651846182; cv=none; d=google.com; s=arc-20160816; b=fOFZjxyXgCEibdIDYx/KPx4NyMM/7Dbw74mFxZxeiYZMVclfgUi6XOojylu102ghfx 5fxRd71hYok/GLOBYuAoAt1lnXsXAfsQlpLaO9aVnenBdVuatVYzswV5yiAsqXSegghB 1Ph1xBkkJCrYh5dW6IxehIBeVM7KRMNQzwgKsZlcBVbYEcH6VbmShjbrVM6pYRpVbxQW J5BxbQrSljTCImGML1PCTbgtaIbBQwH4Fbn7Sla4FIGPcwwvA80f4FAicf4xQDNeR2a+ Fwur5mBHjaVx1pskmfR5dJ2NcWNqgNvf0s5wF2NadEm5ytEk2T3UUcanVQwWT7EkzcfZ DY1A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=vD0lj92322KgZpdRMEMuoKMcjg7LI3wYeAhau2HF3Ag=; b=gcdAdEN+2sgdMH0pQPIDBhzrEeiJuG6hGRGrvAJ9+FK0HGAaUmxcB6AT1Rn25HmJo0 UZNCFpg07GdsFRikgtYInzGXTWmGAN29pgo7Dd+sRIDIO2UPX5z03WrOpfoW68nespZK R4jUEkVkcnB9qd54lcaIPA9b6UErQ1My0L7MrmAEkfX+sDlMrcNkAVOVclJdA4r90Jtz C4DpNSo2vVa7j5IT1KnDHeOfkNosl2k7goMPxK9NWw8Pwk3rk5ZTN8LZIdC3Djk9cGhY vXzZg7ejH4tyN4TJx7kaZg+HwJ+WZ4VxmpKwsB/bqvhUxC90PrsN9UbbKKm+v1vdK/Du lysg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=u8cagx1K; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id a21-20020a056602149500b0065a588f9cc9si2982537iow.18.2022.05.06.07.09.27; Fri, 06 May 2022 07:09:42 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=u8cagx1K; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376741AbiEDRzP (ORCPT + 99 others); Wed, 4 May 2022 13:55:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56490 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357795AbiEDRPQ (ORCPT ); Wed, 4 May 2022 13:15:16 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 24B3855491; Wed, 4 May 2022 09:59:01 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 226B0B827A0; Wed, 4 May 2022 16:58:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B1441C385A4; Wed, 4 May 2022 16:58:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1651683538; bh=gTSwULzluSSgYRiQsdp4wV9Mnneb1sdZlUUEE99Wd9I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=u8cagx1KZOPDnwGKlieoF0/K4d4nNqqcEMSyEvF5XGRelIFqYVHkVmsMEqtR1Ibv+ eY4nHUut86GLzdYltlsahHouPcoEER3MKMx3KCYpLMP0gog8ScqCjoQTOFI0YZyaNM 6DgYJJvN5SOuTSuYPHxlfQeHqDpFCw5X7FtPum6Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 5.17 209/225] tty: n_gsm: fix insufficient txframe size Date: Wed, 4 May 2022 18:47:27 +0200 Message-Id: <20220504153128.691067193@linuxfoundation.org> X-Mailer: git-send-email 2.36.0 In-Reply-To: <20220504153110.096069935@linuxfoundation.org> References: <20220504153110.096069935@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-7.7 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Daniel Starke commit 535bf600de75a859698892ee873521a48d289ec1 upstream. n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=1516 The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to the newer 27.010 here. Chapter 5.7.2 states that the maximum frame size (N1) refers to the length of the information field (i.e. user payload). However, 'txframe' stores the whole frame including frame header, checksum and start/end flags. We also need to consider the byte stuffing overhead. Define constant for the protocol overhead and adjust the 'txframe' size calculation accordingly to reserve enough space for a complete mux frame including byte stuffing for advanced option mode. Note that no byte stuffing is applied to the start and end flag. Also use MAX_MTU instead of MAX_MRU as this buffer is used for data transmission. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220414094225.4527-8-daniel.starke@siemens.com Signed-off-by: Greg Kroah-Hartman --- drivers/tty/n_gsm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -73,6 +73,8 @@ module_param(debug, int, 0600); */ #define MAX_MRU 1500 #define MAX_MTU 1500 +/* SOF, ADDR, CTRL, LEN1, LEN2, ..., FCS, EOF */ +#define PROT_OVERHEAD 7 #define GSM_NET_TX_TIMEOUT (HZ*10) /* @@ -2264,7 +2266,7 @@ static struct gsm_mux *gsm_alloc_mux(voi kfree(gsm); return NULL; } - gsm->txframe = kmalloc(2 * MAX_MRU + 2, GFP_KERNEL); + gsm->txframe = kmalloc(2 * (MAX_MTU + PROT_OVERHEAD - 1), GFP_KERNEL); if (gsm->txframe == NULL) { kfree(gsm->buf); kfree(gsm);