diff options
| author | Foster Snowhill <forst@pen.gy> | 2025-01-26 02:54:04 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-02-17 12:05:16 +0300 |
| commit | 387ec9277a9e74db5c28b0be74bb3e4db850fb75 (patch) | |
| tree | 80e9daa5b5eb325168c3978fde42308e046148db | |
| parent | cf1ac7f7cf601ac31d1580559c002b5e37b733b7 (diff) | |
| download | linux-387ec9277a9e74db5c28b0be74bb3e4db850fb75.tar.xz | |
usbnet: ipheth: check that DPE points past NCM header
commit 429fa68b58cefb9aa9de27e4089637298b46b757 upstream.
By definition, a DPE points at the start of a network frame/datagram.
Thus it makes no sense for it to point at anything that's part of the
NCM header. It is not a security issue, but merely an indication of
a malformed DPE.
Enforce that all DPEs point at the data portion of the URB, past the
NCM header.
Fixes: a2d274c62e44 ("usbnet: ipheth: add CDC NCM support")
Cc: stable@vger.kernel.org
Signed-off-by: Foster Snowhill <forst@pen.gy>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/net/usb/ipheth.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c index ebf5b5f0143b..c385623596d2 100644 --- a/drivers/net/usb/ipheth.c +++ b/drivers/net/usb/ipheth.c @@ -241,7 +241,8 @@ static int ipheth_rcvbulk_callback_ncm(struct urb *urb) dpe = ncm0->dpe16; while (le16_to_cpu(dpe->wDatagramIndex) != 0 && le16_to_cpu(dpe->wDatagramLength) != 0) { - if (le16_to_cpu(dpe->wDatagramIndex) >= urb->actual_length || + if (le16_to_cpu(dpe->wDatagramIndex) < IPHETH_NCM_HEADER_SIZE || + le16_to_cpu(dpe->wDatagramIndex) >= urb->actual_length || le16_to_cpu(dpe->wDatagramLength) > urb->actual_length - le16_to_cpu(dpe->wDatagramIndex)) { dev->net->stats.rx_length_errors++; |