diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2026-04-12 23:19:07 +0300 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-04-12 23:19:08 +0300 |
| commit | 2654557112d6ca298d0ef43b56e4cafb5cc0cb10 (patch) | |
| tree | 516c90cac711f2886e539a8005a35587ec2b2ed7 | |
| parent | 2835750dd6475a5ddc116be0b4c81fee8ce1a902 (diff) | |
| parent | 8263e484d6622464ec72a5ad563f62492d84fa54 (diff) | |
| download | linux-2654557112d6ca298d0ef43b56e4cafb5cc0cb10.tar.xz | |
Merge branch 'net-hamradio-fix-missing-input-validation-in-bpqether-and-scc'
Mashiro Chen says:
====================
net: hamradio: fix missing input validation in bpqether and scc
This series fixes two missing input validation bugs in the hamradio
drivers. Both patches were reviewed by Joerg Reuter (hamradio
maintainer).
====================
Link: https://patch.msgid.link/20260409024927.24397-1-mashiro.chen@mailbox.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | drivers/net/hamradio/bpqether.c | 3 | ||||
| -rw-r--r-- | drivers/net/hamradio/scc.c | 2 |
2 files changed, 5 insertions, 0 deletions
diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c index 045c5177262e..214fd1f819a1 100644 --- a/drivers/net/hamradio/bpqether.c +++ b/drivers/net/hamradio/bpqether.c @@ -187,6 +187,9 @@ static int bpq_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_ty len = skb->data[0] + skb->data[1] * 256 - 5; + if (len < 0 || len > skb->len - 2) + goto drop_unlock; + skb_pull(skb, 2); /* Remove the length bytes */ skb_trim(skb, len); /* Set the length of the data */ diff --git a/drivers/net/hamradio/scc.c b/drivers/net/hamradio/scc.c index ae5048efde68..8569db4a7140 100644 --- a/drivers/net/hamradio/scc.c +++ b/drivers/net/hamradio/scc.c @@ -1909,6 +1909,8 @@ static int scc_net_siocdevprivate(struct net_device *dev, if (!capable(CAP_SYS_RAWIO)) return -EPERM; if (!arg || copy_from_user(&memcfg, arg, sizeof(memcfg))) return -EINVAL; + if (memcfg.bufsize < 16) + return -EINVAL; scc->stat.bufsize = memcfg.bufsize; return 0; |