Re: [PATCH net v2 2/2] net: usb: pegasus: check rx pkt_len against the received length

[sashiko-bot@kernel.org]

> read_bulk_callback() takes the frame length from the device, from the
> receive header on the 0x8513 and from the trailing status bytes on the
> other chips, and only checks it against PEGASUS_MTU before passing that
> many bytes up the stack. In two cases the stack then uses bytes that the
> device did not send:
> 
> - A device that sends a short transfer but claims a long frame gets the
>   stale or uninitialized remainder of the receive skb delivered as
>   packet data.
> 
> - A device that claims a frame shorter than an Ethernet header gets
>   past the check as well. eth_type_trans() takes pkt_type from h_dest
>   and the protocol from h_proto without checking skb->len. If the
>   transfer is also short, those come from bytes left in the skb by an
>   earlier transfer, or from uninitialized memory.
> [ ... ]
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Wei Jie Law <law.wei.jie@gt.tech.gov.sg>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261021020310.34045-1-law.wei.jie@gt.tech.gov.sg?part=2