[PATCH net] net: usb: cx82310_eth: bound partial-frame remainder by current skb length

[PATCH net] net: usb: cx82310_eth: bound partial-frame remainder by current skb length

[Jason Winter]

When a frame straddles two bulk URBs, cx82310_rx_fixup() stores the
number of bytes still expected in dev->partial_rem and on the next call
memcpy()s that many bytes from the new skb without checking that the new
URB actually delivered that much data. A malicious device can declare a
large frame in one URB and follow it with a short URB, causing the
memcpy to read past the valid skb data into uncleared bytes in the
receive buffer and forward the result up the network stack.

Drop the partial frame and reset the carry-over state if the current skb
is shorter than the recorded remainder.

Fixes: cc28a20e77b2 ("introduce cx82310_eth: Conexant CX82310-based ADSL router USB ethernet driver")
Assisted-by: gkh_clanker_t1000
Signed-off-by: Jason Winter <jjx@live.nl>
---
 drivers/net/usb/cx82310_eth.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c
index 068acb052adb..8ca6b75fdd20 100644
--- a/drivers/net/usb/cx82310_eth.c
+++ b/drivers/net/usb/cx82310_eth.c
@@ -251,6 +251,13 @@ static int cx82310_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 	 * end of that packet at the beginning.
 	 */
 	if (dev->partial_rem) {
+		if (dev->partial_rem > skb->len) {
+			netdev_err(dev->net,
+				   "RX partial frame: need %lu, got %u\n",
+				   dev->partial_rem, skb->len);
+			dev->partial_rem = 0;
+			return 0;
+		}
 		len = dev->partial_len + dev->partial_rem;
 		skb2 = alloc_skb(len, GFP_ATOMIC);
 		if (!skb2)
-- 
2.55.0

Re: [PATCH net] net: usb: cx82310_eth: bound partial-frame remainder by current skb length

[Andrew Lunn]

On Fri, Aug 14, 2026 at 09:08:14PM +0200, Jason Winter wrote:
> When a frame straddles two bulk URBs, cx82310_rx_fixup() stores the
> number of bytes still expected in dev->partial_rem and on the next call
> memcpy()s that many bytes from the new skb without checking that the new
> URB actually delivered that much data. A malicious device

So this is somewhat theoretical. Maybe less so than average, since
this is a USB dongle, but still, does it bother people?

Please drop the Fixes: tag and post for net-next.

https://www.kernel.org/doc/html/latest/process/maintainer-netdev.html

    Andrew

---
pw-bot: cr