From: sashiko-bot@kernel.org
To: "Ryan Prinz" <rc4d5a@protonmail.com>
Cc: linux-usb@vger.kernel.org
Subject: Re: [PATCH net v3] net: usb: cdc_ncm: fix out-of-bounds read of chained NDP32 offset
Date: Thu, 12 Nov 2026 08:27:25 +0000 [thread overview]
Message-ID: <sashiko-outbox-210715@kernel.org> (raw)
In-Reply-To: <20261112082022.995351-1-rc4d5a@protonmail.com>
> The NDP offset read from dwNextNdpIndex on the 32-bit NTB (NDP32)
> path is not checked for a negative value before use. A
> device-supplied dwNextNdpIndex in the 0xFFFFFFF0-0xFFFFFFFF range
> sign-converts to a small negative int. cdc_ncm_rx_verify_ndp32()'s
> existing bounds check then double-wraps: promoting the negative int
> to size_t first produces a huge value, and adding
> sizeof(struct usb_cdc_ncm_ndp32) to that wraps it back down to a
> small value that passes the "> skb_in->len" check, causing an
> out-of-bounds read of up to 16 bytes before the skb's data buffer.
>
> Fixes: 0fa81b304a79 ("cdc_ncm: Implement the 32-bit version of NCM Transfer Block")
> Signed-off-by: Ryan Prinz <rc4d5a@protonmail.com>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261112082022.995351-1-rc4d5a@protonmail.com?part=1
prev parent reply other threads:[~2026-11-12 8:27 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-07 14:06 [PATCH] net: usb: cdc_ncm: fix out-of-bounds read of chained NDP32 offset Ryan Prinz
2026-11-12 1:43 ` Jakub Kicinski
2026-11-12 8:22 ` [PATCH net v3] " Ryan Prinz
2026-11-12 8:27 ` sashiko-bot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=sashiko-outbox-210715@kernel.org \
--to=sashiko-bot@kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=rc4d5a@protonmail.com \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.