Patch "usb: aqc111: check packet for fixup for true limit" has been added to the 5.4-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    usb: aqc111: check packet for fixup for true limit

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     usb-aqc111-check-packet-for-fixup-for-true-limit.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 2afcc69a0de659bfd79b823c2c0a36bf02647b5c
Author: Oliver Neukum <oneukum@xxxxxxxx>
Date:   Wed Nov 15 11:08:57 2023 +0100

    usb: aqc111: check packet for fixup for true limit
    
    [ Upstream commit ccab434e674ca95d483788b1895a70c21b7f016a ]
    
    If a device sends a packet that is inbetween 0
    and sizeof(u64) the value passed to skb_trim()
    as length will wrap around ending up as some very
    large value.
    
    The driver will then proceed to parse the header
    located at that position, which will either oops or
    process some random value.
    
    The fix is to check against sizeof(u64) rather than
    0, which the driver currently does. The issue exists
    since the introduction of the driver.
    
    Signed-off-by: Oliver Neukum <oneukum@xxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c
index 68912e266826b..892d58b38cf5b 100644
--- a/drivers/net/usb/aqc111.c
+++ b/drivers/net/usb/aqc111.c
@@ -1079,17 +1079,17 @@ static int aqc111_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 	u16 pkt_count = 0;
 	u64 desc_hdr = 0;
 	u16 vlan_tag = 0;
-	u32 skb_len = 0;
+	u32 skb_len;
 
 	if (!skb)
 		goto err;
 
-	if (skb->len == 0)
+	skb_len = skb->len;
+	if (skb_len < sizeof(desc_hdr))
 		goto err;
 
-	skb_len = skb->len;
 	/* RX Descriptor Header */
-	skb_trim(skb, skb->len - sizeof(desc_hdr));
+	skb_trim(skb, skb_len - sizeof(desc_hdr));
 	desc_hdr = le64_to_cpup((u64 *)skb_tail_pointer(skb));
 
 	/* Check these packets */




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux