* [PATCH] usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
@ 2026-07-03 5:19 Sonali Pradhan
2026-07-03 5:49 ` Greg KH
0 siblings, 1 reply; 3+ messages in thread
From: Sonali Pradhan @ 2026-07-03 5:19 UTC (permalink / raw)
To: sonalipradhan; +Cc: stable
When unpacking host-supplied NTBs, ncm_unwrap_ntb() checks datagram length
against frame_max but does not verify that the datagram fits within the
declared block length. Additionally, when decoding multiple NTBs from a
single socket buffer, subsequent block lengths are not checked against the
actual remaining buffer data.
With these checks missing, a malicious USB host can specify datagram
offsets and lengths that point beyond the block, or supply secondary NTB
headers declaring lengths larger than the buffer. skb_put_data() then
copies adjacent kernel memory from skb_shared_info into the network skb.
Fix this by verifying that sufficient buffer space remains for the NTB
header before parsing, handling zero-length block declarations, ensuring
that block lengths never exceed the remaining buffer space, and verifying
that each datagram payload stays strictly within the block boundary.
Fixes: 427694cfaafa ("usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call")
Fixes: 2b74b0a04d3e ("USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb()")
Cc: stable@vger.kernel.org
Assisted-by: Jetski:Gemini-2.5-Pro
Signed-off-by: Sonali Pradhan <sonalipradhan@google.com>
---
drivers/usb/gadget/function/f_ncm.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
index c5bf8a448d64..64eabda2f546 100644
--- a/drivers/usb/gadget/function/f_ncm.c
+++ b/drivers/usb/gadget/function/f_ncm.c
@@ -1189,6 +1189,10 @@ static int ncm_unwrap_ntb(struct gether *port,
frame_max = ncm_opts->max_segment_size;
parse_ntb:
+ if (to_process < (int)opts->nth_size) {
+ INFO(port->func.config->cdev, "Packet too small for headers\n");
+ goto err;
+ }
tmp = (__le16 *)ntb_ptr;
/* dwSignature */
@@ -1209,8 +1213,12 @@ static int ncm_unwrap_ntb(struct gether *port,
tmp++; /* skip wSequence */
block_len = get_ncm(&tmp, opts->block_length);
+ if (block_len == 0)
+ block_len = to_process;
+
/* (d)wBlockLength */
- if ((block_len < opts->nth_size + opts->ndp_size) || (block_len > ntb_max)) {
+ if ((block_len < opts->nth_size + opts->ndp_size) || (block_len > ntb_max) ||
+ (block_len > to_process)) {
INFO(port->func.config->cdev, "Bad block length: %#X\n", block_len);
goto err;
}
@@ -1273,7 +1281,7 @@ static int ncm_unwrap_ntb(struct gether *port,
index = index2;
/* wDatagramIndex[0] */
if ((index < opts->nth_size) ||
- (index > block_len - opts->dpe_size)) {
+ (index > block_len)) {
INFO(port->func.config->cdev,
"Bad index: %#X\n", index);
goto err;
@@ -1285,7 +1293,8 @@ static int ncm_unwrap_ntb(struct gether *port,
* ethernet hdr + crc or larger than max frame size
*/
if ((dg_len < 14 + crc_len) ||
- (dg_len > frame_max)) {
+ (dg_len > frame_max) ||
+ (dg_len > block_len - index)) {
INFO(port->func.config->cdev,
"Bad dgram length: %#X\n", dg_len);
goto err;
@@ -1310,7 +1319,7 @@ static int ncm_unwrap_ntb(struct gether *port,
dg_len2 = get_ncm(&tmp, opts->dgram_item_len);
/* wDatagramIndex[1] */
- if (index2 > block_len - opts->dpe_size) {
+ if (index2 > block_len) {
INFO(port->func.config->cdev,
"Bad index: %#X\n", index2);
goto err;
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
2026-07-03 5:19 [PATCH] usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() Sonali Pradhan
@ 2026-07-03 5:49 ` Greg KH
0 siblings, 0 replies; 3+ messages in thread
From: Greg KH @ 2026-07-03 5:49 UTC (permalink / raw)
To: Sonali Pradhan; +Cc: stable
On Fri, Jul 03, 2026 at 05:19:45AM +0000, Sonali Pradhan wrote:
> When unpacking host-supplied NTBs, ncm_unwrap_ntb() checks datagram length
> against frame_max but does not verify that the datagram fits within the
> declared block length. Additionally, when decoding multiple NTBs from a
> single socket buffer, subsequent block lengths are not checked against the
> actual remaining buffer data.
>
> With these checks missing, a malicious USB host can specify datagram
> offsets and lengths that point beyond the block, or supply secondary NTB
> headers declaring lengths larger than the buffer. skb_put_data() then
> copies adjacent kernel memory from skb_shared_info into the network skb.
>
> Fix this by verifying that sufficient buffer space remains for the NTB
> header before parsing, handling zero-length block declarations, ensuring
> that block lengths never exceed the remaining buffer space, and verifying
> that each datagram payload stays strictly within the block boundary.
>
> Fixes: 427694cfaafa ("usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call")
> Fixes: 2b74b0a04d3e ("USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb()")
> Cc: stable@vger.kernel.org
> Assisted-by: Jetski:Gemini-2.5-Pro
> Signed-off-by: Sonali Pradhan <sonalipradhan@google.com>
> ---
> drivers/usb/gadget/function/f_ncm.c | 17 +++++++++++++----
> 1 file changed, 13 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
> index c5bf8a448d64..64eabda2f546 100644
> --- a/drivers/usb/gadget/function/f_ncm.c
> +++ b/drivers/usb/gadget/function/f_ncm.c
> @@ -1189,6 +1189,10 @@ static int ncm_unwrap_ntb(struct gether *port,
> frame_max = ncm_opts->max_segment_size;
>
> parse_ntb:
> + if (to_process < (int)opts->nth_size) {
> + INFO(port->func.config->cdev, "Packet too small for headers\n");
> + goto err;
> + }
> tmp = (__le16 *)ntb_ptr;
>
> /* dwSignature */
> @@ -1209,8 +1213,12 @@ static int ncm_unwrap_ntb(struct gether *port,
> tmp++; /* skip wSequence */
>
> block_len = get_ncm(&tmp, opts->block_length);
> + if (block_len == 0)
> + block_len = to_process;
> +
> /* (d)wBlockLength */
> - if ((block_len < opts->nth_size + opts->ndp_size) || (block_len > ntb_max)) {
> + if ((block_len < opts->nth_size + opts->ndp_size) || (block_len > ntb_max) ||
> + (block_len > to_process)) {
> INFO(port->func.config->cdev, "Bad block length: %#X\n", block_len);
> goto err;
> }
> @@ -1273,7 +1281,7 @@ static int ncm_unwrap_ntb(struct gether *port,
> index = index2;
> /* wDatagramIndex[0] */
> if ((index < opts->nth_size) ||
> - (index > block_len - opts->dpe_size)) {
> + (index > block_len)) {
> INFO(port->func.config->cdev,
> "Bad index: %#X\n", index);
> goto err;
> @@ -1285,7 +1293,8 @@ static int ncm_unwrap_ntb(struct gether *port,
> * ethernet hdr + crc or larger than max frame size
> */
> if ((dg_len < 14 + crc_len) ||
> - (dg_len > frame_max)) {
> + (dg_len > frame_max) ||
> + (dg_len > block_len - index)) {
> INFO(port->func.config->cdev,
> "Bad dgram length: %#X\n", dg_len);
> goto err;
> @@ -1310,7 +1319,7 @@ static int ncm_unwrap_ntb(struct gether *port,
> dg_len2 = get_ncm(&tmp, opts->dgram_item_len);
>
> /* wDatagramIndex[1] */
> - if (index2 > block_len - opts->dpe_size) {
> + if (index2 > block_len) {
> INFO(port->func.config->cdev,
> "Bad index: %#X\n", index2);
> goto err;
> --
> 2.55.0.rc0.799.gd6f94ed593-goog
>
>
<formletter>
This is not the correct way to submit patches for inclusion in the
stable kernel tree. Please read:
https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.
</formletter>
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH] usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
@ 2026-07-03 8:37 Sonali Pradhan
0 siblings, 0 replies; 3+ messages in thread
From: Sonali Pradhan @ 2026-07-03 8:37 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-usb, linux-kernel, Kuen-Han Tsai, Maciej Żenczykowski,
raub camaioni, Kees Cook, Krishna Kurapati, Brooke Basile,
Felipe Balbi, stable, Sonali Pradhan
When unpacking host-supplied NTBs, ncm_unwrap_ntb() checks datagram length
against frame_max but does not verify that the datagram fits within the
declared block length. Additionally, when decoding multiple NTBs from a
single socket buffer, subsequent block lengths are not checked against the
actual remaining buffer data.
With these checks missing, a malicious USB host can specify datagram
offsets and lengths that point beyond the block, or supply secondary NTB
headers declaring lengths larger than the buffer. skb_put_data() then
copies adjacent kernel memory from skb_shared_info into the network skb.
Fix this by verifying that sufficient buffer space remains for the NTB
header before parsing, handling zero-length block declarations, ensuring
that block lengths never exceed the remaining buffer space, and verifying
that each datagram payload stays strictly within the block boundary.
Fixes: 427694cfaafa ("usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call")
Fixes: 2b74b0a04d3e ("USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb()")
Cc: stable@vger.kernel.org
Assisted-by: Jetski:Gemini-2.5-Pro
Signed-off-by: Sonali Pradhan <sonalipradhan@google.com>
---
drivers/usb/gadget/function/f_ncm.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
index c5bf8a448d64..64eabda2f546 100644
--- a/drivers/usb/gadget/function/f_ncm.c
+++ b/drivers/usb/gadget/function/f_ncm.c
@@ -1189,6 +1189,10 @@ static int ncm_unwrap_ntb(struct gether *port,
frame_max = ncm_opts->max_segment_size;
parse_ntb:
+ if (to_process < (int)opts->nth_size) {
+ INFO(port->func.config->cdev, "Packet too small for headers\n");
+ goto err;
+ }
tmp = (__le16 *)ntb_ptr;
/* dwSignature */
@@ -1209,8 +1213,12 @@ static int ncm_unwrap_ntb(struct gether *port,
tmp++; /* skip wSequence */
block_len = get_ncm(&tmp, opts->block_length);
+ if (block_len == 0)
+ block_len = to_process;
+
/* (d)wBlockLength */
- if ((block_len < opts->nth_size + opts->ndp_size) || (block_len > ntb_max)) {
+ if ((block_len < opts->nth_size + opts->ndp_size) || (block_len > ntb_max) ||
+ (block_len > to_process)) {
INFO(port->func.config->cdev, "Bad block length: %#X\n", block_len);
goto err;
}
@@ -1273,7 +1281,7 @@ static int ncm_unwrap_ntb(struct gether *port,
index = index2;
/* wDatagramIndex[0] */
if ((index < opts->nth_size) ||
- (index > block_len - opts->dpe_size)) {
+ (index > block_len)) {
INFO(port->func.config->cdev,
"Bad index: %#X\n", index);
goto err;
@@ -1285,7 +1293,8 @@ static int ncm_unwrap_ntb(struct gether *port,
* ethernet hdr + crc or larger than max frame size
*/
if ((dg_len < 14 + crc_len) ||
- (dg_len > frame_max)) {
+ (dg_len > frame_max) ||
+ (dg_len > block_len - index)) {
INFO(port->func.config->cdev,
"Bad dgram length: %#X\n", dg_len);
goto err;
@@ -1310,7 +1319,7 @@ static int ncm_unwrap_ntb(struct gether *port,
dg_len2 = get_ncm(&tmp, opts->dgram_item_len);
/* wDatagramIndex[1] */
- if (index2 > block_len - opts->dpe_size) {
+ if (index2 > block_len) {
INFO(port->func.config->cdev,
"Bad index: %#X\n", index2);
goto err;
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-03 8:37 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-03 5:19 [PATCH] usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() Sonali Pradhan
2026-07-03 5:49 ` Greg KH
-- strict thread matches above, loose matches on Subject: below --
2026-07-03 8:37 Sonali Pradhan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox