* [PATCH] sr9700: improve packet length sanity check
@ 2022-07-14 13:21 Thadeu Lima de Souza Cascardo
2022-07-19 3:07 ` Jakub Kicinski
0 siblings, 1 reply; 2+ messages in thread
From: Thadeu Lima de Souza Cascardo @ 2022-07-14 13:21 UTC (permalink / raw)
To: netdev
Cc: linux-usb, oneukum, grundler, pabeni, kuba, edumazet, davem,
Thadeu Lima de Souza Cascardo
The packet format includes a 3 byte headers and a 4 byte CRC. Account for
that when checking the given length is not larger than the skb length.
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Fixes: e9da0b56fe27 ("sr9700: sanity check for packet length")
---
drivers/net/usb/sr9700.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
index 5a53e63d33a6..09bb40ac6e09 100644
--- a/drivers/net/usb/sr9700.c
+++ b/drivers/net/usb/sr9700.c
@@ -413,7 +413,7 @@ static int sr9700_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
/* ignore the CRC length */
len = (skb->data[1] | (skb->data[2] << 8)) - 4;
- if (len > ETH_FRAME_LEN || len > skb->len)
+ if (len > ETH_FRAME_LEN || len + SR_RX_OVERHEAD > skb->len)
return 0;
/* the last packet of current skb */
--
2.34.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] sr9700: improve packet length sanity check
2022-07-14 13:21 [PATCH] sr9700: improve packet length sanity check Thadeu Lima de Souza Cascardo
@ 2022-07-19 3:07 ` Jakub Kicinski
0 siblings, 0 replies; 2+ messages in thread
From: Jakub Kicinski @ 2022-07-19 3:07 UTC (permalink / raw)
To: Thadeu Lima de Souza Cascardo
Cc: netdev, linux-usb, oneukum, grundler, pabeni, edumazet, davem
On Thu, 14 Jul 2022 10:21:34 -0300 Thadeu Lima de Souza Cascardo wrote:
> The packet format includes a 3 byte headers and a 4 byte CRC. Account for
> that when checking the given length is not larger than the skb length.
Please describe in detail the issue you're fixing. What will happen if
we don't include SR_RX_OVERHEAD in the check.
> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
> Fixes: e9da0b56fe27 ("sr9700: sanity check for packet length")
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-07-19 3:07 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-07-14 13:21 [PATCH] sr9700: improve packet length sanity check Thadeu Lima de Souza Cascardo
2022-07-19 3:07 ` Jakub Kicinski
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).