Re: [PATCH v5] net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler

[Simon Horman <horms@kernel.org>]

This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.

For local reproduction steps see https://netdev-ai.bots.linux.dev/ai-local.html
---
net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler

t7xx_port_enum_msg_handler() uses the modem-supplied port_count field as
a loop bound over port_msg->data[] without checking that the message buffer
contains sufficient data. A modem sending port_count=65535 in a 12-byte
buffer triggers a slab-out-of-bounds read of up to 262140 bytes.

Add a struct_size() check after extracting port_count and before the loop.
Pass msg_len to t7xx_port_enum_msg_handler() and use it to validate
the message size before accessing port_msg->data[].
Pass msg_len from both call sites: skb->len at the DPMAIF path after
skb_pull(), and the captured rt_feature->data_len at the handshake path.

> Fixes: 39d439047f1d ("net: wwan: t7xx: Add control DMA interface")

The Fixes: tag appears to reference the wrong commit. The vulnerable
function t7xx_port_enum_msg_handler() was added in commit da45d2566a1d
("net: wwan: t7xx: Add control port"), not in 39d439047f1d.

The bug being fixed is the missing validation of port_count against
message length before accessing port_msg->data[i] in the loop. This
validation was absent from the initial implementation in da45d2566a1d.

Should the Fixes: tag be:
  Fixes: da45d2566a1d ("net: wwan: t7xx: Add control port")