Attachment 870766 Details for Bug 1217169

[patch] check for the true - higher - minimum length

0001-usb-aqc111-check-packet-for-fixup-for-true-limit.patch (text/plain), 1.47 KB, created by Oliver Neukum on 2023-11-15 10:02:18 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Oliver Neukum

Created: 2023-11-15 10:02:18 UTC

Size: 1.47 KB

patch

obsolete

>From 6c13ad42bc5c0dc6817a1d17820cfcab0897e9fb Mon Sep 17 00:00:00 2001
>From: Oliver Neukum <oneukum@suse.com>
>Date: Wed, 15 Nov 2023 10:30:51 +0100
>Subject: [PATCH] usb: aqc111: check packet for fixup for true limit
>
>If a device sends a packet that is inbetween 0
>and sizeof(u64) the value passed to skb_trim()
>as length will wrap around ending up as some very
>large value.
>
>The driver will then proceed to parse the header
>located at that position, which will either oops or
>process some random value.
>
>The fix is to check against sizeof(u64) rather than
>0, which the driver currently does. The issue exists
>since the introduction of the driver.
>
>Signed-off-by: Oliver Neukum <oneukum@suse.com>
>---
> drivers/net/usb/aqc111.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
>diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c
>index a017e9de2119..7b8afa589a53 100644
>--- a/drivers/net/usb/aqc111.c
>+++ b/drivers/net/usb/aqc111.c
>@@ -1079,17 +1079,17 @@ static int aqc111_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
> 	u16 pkt_count = 0;
> 	u64 desc_hdr = 0;
> 	u16 vlan_tag = 0;
>-	u32 skb_len = 0;
>+	u32 skb_len;
> 
> 	if (!skb)
> 		goto err;
> 
>-	if (skb->len == 0)
>+	skb_len = skb->len;
>+	if (skb_len < sizeof(desc_hdr))
> 		goto err;
> 
>-	skb_len = skb->len;
> 	/* RX Descriptor Header */
>-	skb_trim(skb, skb->len - sizeof(desc_hdr));
>+	skb_trim(skb, skb_len - sizeof(desc_hdr));
> 	desc_hdr = le64_to_cpup((u64 *)skb_tail_pointer(skb));
> 
> 	/* Check these packets */
>-- 
>2.42.0
>

Actions: View | Diff

Attachments on bug 1217169: 870766