[PATCH net 5/6] net/ncsi: validate AEN packet lengths against the skb

Michael Bommarito
2026-04-22T16:05:13Z

AEN packets are dispatched after only pulling the 16-byte common
header. ncsi_aen_handler() then reads the 20-byte AEN header to
select a per-type handler, and ncsi_validate_aen_pkt() walks
farther into the payload and checksum without first ensuring the
skb contains those bytes.

Pull the AEN-specific header before reading h->type, and pull the
full AEN header plus aligned payload before checksum validation.
That keeps short AEN packets from reading past the skb tail on the
AEN path.

Fixes: 2d283bdd079c ("net/ncsi: Resource management")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
---
net/ncsi/ncsi-aen.c | 30 +++++++++++++++++++++++-------
1 file changed, 23 insertions(+), 7 deletions(-)

diff --git a/net/ncsi/ncsi-aen.c b/net/ncsi/ncsi-aen.c
index 040a31557201..cd34ef144cf8 100644
--- a/net/ncsi/ncsi-aen.c
+++ b/net/ncsi/ncsi-aen.c
@@ -16,11 +16,19 @@
#include "internal.h"
#include "ncsi-pkt.h"

-static int ncsi_validate_aen_pkt(struct ncsi_aen_pkt_hdr *h,
+static int ncsi_validate_aen_pkt(struct sk_buff *skb,
const unsigned short payload)
{
+ struct ncsi_aen_pkt_hdr *h;
u32 checksum;
__be32 *pchecksum;
+ unsigned int len;
+
+ len = skb_network_offset(skb) + sizeof(*h) + ALIGN(payload, 4);
+ if (!pskb_may_pull(skb, len))
+ return -EINVAL;
+
+ h = (struct ncsi_aen_pkt_hdr *)skb_network_header(skb);

if (h->common.revision != NCSI_PKT_REVISION)
return -EINVAL;
@@ -31,7 +39,7 @@ static int ncsi_validate_aen_pkt(struct ncsi_aen_pkt_hdr *h,
* sender doesn't support checksum according to NCSI
* specification.
*/
- pchecksum = (__be32 *)((void *)(h + 1) + payload - 4);
+ pchecksum = (__be32 *)((void *)(h + 1) + ALIGN(payload, 4) - 4);
if (ntohl(*pchecksum) == 0)
return 0;

@@ -210,12 +218,19 @@ int ncsi_aen_handler(struct ncsi_dev_priv *ndp, struct sk_buff *skb)
{
struct ncsi_aen_pkt_hdr *h;
struct ncsi_aen_handler *nah = NULL;
+ unsigned char type;
int i, ret;

+ if (!pskb_may_pull(skb, skb_network_offset(skb) + sizeof(*h))) {
+ ret = -EINVAL;
+ goto out;
+ }
+
/* Find the handler */
h = (struct ncsi_aen_pkt_hdr *)skb_network_header(skb);
+ type = h->type;
for (i = 0; i < ARRAY_SIZE(ncsi_aen_handlers); i++) {
- if (ncsi_aen_handlers[i].type == h->type) {
+ if (ncsi_aen_handlers[i].type == type) {
nah = &ncsi_aen_handlers[i];
break;
}
@@ -223,24 +238,25 @@ int ncsi_aen_handler(struct ncsi_dev_priv *ndp, struct sk_buff *skb)

if (!nah) {
netdev_warn(ndp->ndev.dev, "Invalid AEN (0x%x) received\n",
- h->type);
+ type);
ret = -ENOENT;
goto out;
}

- ret = ncsi_validate_aen_pkt(h, nah->payload);
+ ret = ncsi_validate_aen_pkt(skb, nah->payload);
if (ret) {
netdev_warn(ndp->ndev.dev,
"NCSI: 'bad' packet ignored for AEN type 0x%x\n",
- h->type);
+ type);
goto out;
}

+ h = (struct ncsi_aen_pkt_hdr *)skb_network_header(skb);
ret = nah->handler(ndp, h);
if (ret)
netdev_err(ndp->ndev.dev,
"NCSI: Handler for AEN type 0x%x returned %d\n",
- h->type, ret);
+ type, ret);
out:
consume_skb(skb);
return ret;
--
2.53.0