From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Oliver Neukum <oneukum@suse.com>,
Grant Grundler <grundler@chromium.org>,
"David S . Miller" <davem@davemloft.net>,
Sasha Levin <sashal@kernel.org>,
kuba@kernel.org, jgg@ziepe.ca, arnd@arndb.de,
linux-usb@vger.kernel.org, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.4 04/11] sr9700: sanity check for packet length
Date: Tue, 1 Mar 2022 15:19:37 -0500 [thread overview]
Message-ID: <20220301201951.19066-4-sashal@kernel.org> (raw)
In-Reply-To: <20220301201951.19066-1-sashal@kernel.org>
From: Oliver Neukum <oneukum@suse.com>
[ Upstream commit e9da0b56fe27206b49f39805f7dcda8a89379062 ]
A malicious device can leak heap data to user space
providing bogus frame lengths. Introduce a sanity check.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reviewed-by: Grant Grundler <grundler@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/sr9700.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
index e04c8054c2cf3..fce6713e970ba 100644
--- a/drivers/net/usb/sr9700.c
+++ b/drivers/net/usb/sr9700.c
@@ -410,7 +410,7 @@ static int sr9700_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
/* ignore the CRC length */
len = (skb->data[1] | (skb->data[2] << 8)) - 4;
- if (len > ETH_FRAME_LEN)
+ if (len > ETH_FRAME_LEN || len > skb->len)
return 0;
/* the last packet of current skb */
--
2.34.1
next prev parent reply other threads:[~2022-03-01 20:24 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-01 20:19 [PATCH AUTOSEL 5.4 01/11] selftests/bpf: Add test for bpf_timer overwriting crash Sasha Levin
2022-03-01 20:19 ` [PATCH AUTOSEL 5.4 02/11] KVM: Fix lockdep false negative during host resume Sasha Levin
2022-03-01 20:22 ` Paolo Bonzini
2022-03-01 20:19 ` [PATCH AUTOSEL 5.4 03/11] net-sysfs: add check for netdevice being present to speed_show Sasha Levin
2022-03-01 20:19 ` Sasha Levin [this message]
2022-03-01 20:19 ` [PATCH AUTOSEL 5.4 05/11] gpio: Return EPROBE_DEFER if gc->to_irq is NULL Sasha Levin
2022-03-01 20:19 ` [PATCH AUTOSEL 5.4 06/11] Revert "xen-netback: remove 'hotplug-status' once it has served its purpose" Sasha Levin
2022-03-01 20:19 ` [PATCH AUTOSEL 5.4 07/11] Revert "xen-netback: Check for hotplug-status existence before watching" Sasha Levin
2022-03-01 20:19 ` [PATCH AUTOSEL 5.4 08/11] ipv6: prevent a possible race condition with lifetimes Sasha Levin
2022-03-01 20:19 ` [PATCH AUTOSEL 5.4 09/11] tracing: Ensure trace buffer is at least 4096 bytes large Sasha Levin
2022-03-01 20:19 ` [PATCH AUTOSEL 5.4 10/11] selftest/vm: fix map_fixed_noreplace test failure Sasha Levin
2022-03-01 20:19 ` [PATCH AUTOSEL 5.4 11/11] selftests/memfd: clean up mapping in mfd_fail_write Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220301201951.19066-4-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=arnd@arndb.de \
--cc=davem@davemloft.net \
--cc=grundler@chromium.org \
--cc=jgg@ziepe.ca \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=oneukum@suse.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.