* [PATCH] net: usb: sr9700: validate receive packet extent
@ 2026-07-05 8:37 Pengpeng Hou
2026-07-06 15:07 ` Andrew Lunn
0 siblings, 1 reply; 3+ messages in thread
From: Pengpeng Hou @ 2026-07-05 8:37 UTC (permalink / raw)
To: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Ethan Nelson-Moore, Peter Korsgaard, Simon Horman,
linux-usb, netdev, linux-kernel
Cc: Pengpeng Hou
sr9700_rx_fixup() copies len bytes from skb->data + SR_RX_OVERHEAD when
a URB contains multiple packets. The old check compared len against
skb->len, but the source pointer has already skipped SR_RX_OVERHEAD
bytes.
Validate len against the remaining bytes after SR_RX_OVERHEAD before the
copy and cursor advance.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
--- a/drivers/net/usb/sr9700.c
+++ b/drivers/net/usb/sr9700.c
@@ -355,7 +355,8 @@
/* ignore the CRC length */
len = (skb->data[1] | (skb->data[2] << 8)) - 4;
- if (len > ETH_FRAME_LEN || len > skb->len || len < 0)
+ if (len > ETH_FRAME_LEN || len < 0 ||
+ len > skb->len - SR_RX_OVERHEAD)
return 0;
/* the last packet of current skb */
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] net: usb: sr9700: validate receive packet extent
2026-07-05 8:37 [PATCH] net: usb: sr9700: validate receive packet extent Pengpeng Hou
@ 2026-07-06 15:07 ` Andrew Lunn
2026-07-07 1:45 ` Pengpeng Hou
0 siblings, 1 reply; 3+ messages in thread
From: Andrew Lunn @ 2026-07-06 15:07 UTC (permalink / raw)
To: Pengpeng Hou
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Ethan Nelson-Moore, Peter Korsgaard, Simon Horman,
linux-usb, netdev, linux-kernel
On Sun, Jul 05, 2026 at 04:37:24PM +0800, Pengpeng Hou wrote:
> sr9700_rx_fixup() copies len bytes from skb->data + SR_RX_OVERHEAD when
> a URB contains multiple packets. The old check compared len against
> skb->len, but the source pointer has already skipped SR_RX_OVERHEAD
> bytes.
>
> Validate len against the remaining bytes after SR_RX_OVERHEAD before the
> copy and cursor advance.
Please fix the Subject: line.
Andrew
---
pw-bot: cr
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] net: usb: sr9700: validate receive packet extent
2026-07-06 15:07 ` Andrew Lunn
@ 2026-07-07 1:45 ` Pengpeng Hou
0 siblings, 0 replies; 3+ messages in thread
From: Pengpeng Hou @ 2026-07-07 1:45 UTC (permalink / raw)
To: Andrew Lunn
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Ethan Nelson-Moore, Peter Korsgaard, Simon Horman,
linux-usb, netdev, linux-kernel
pw-bot: cr
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-07 1:47 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-05 8:37 [PATCH] net: usb: sr9700: validate receive packet extent Pengpeng Hou
2026-07-06 15:07 ` Andrew Lunn
2026-07-07 1:45 ` Pengpeng Hou
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox