diff options
| author | Foster Snowhill <forst@pen.gy> | 2025-01-26 00:54:04 +0100 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2025-01-28 12:16:32 +0100 |
| commit | 429fa68b58cefb9aa9de27e4089637298b46b757 (patch) | |
| tree | 35d06042819c9ed37ba78f09baf2484ad5f2758d | |
| parent | c219427ed296f94bb4b91d08626776dc7719ee27 (diff) | |
usbnet: ipheth: check that DPE points past NCM header
By definition, a DPE points at the start of a network frame/datagram.
Thus it makes no sense for it to point at anything that's part of the
NCM header. It is not a security issue, but merely an indication of
a malformed DPE.
Enforce that all DPEs point at the data portion of the URB, past the
NCM header.
Fixes: a2d274c62e44 ("usbnet: ipheth: add CDC NCM support")
Cc: stable@vger.kernel.org
Signed-off-by: Foster Snowhill <forst@pen.gy>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
| -rw-r--r-- | drivers/net/usb/ipheth.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c index 45daae234cb8..1ff5f7076ad5 100644 --- a/drivers/net/usb/ipheth.c +++ b/drivers/net/usb/ipheth.c @@ -242,7 +242,8 @@ static int ipheth_rcvbulk_callback_ncm(struct urb *urb) dpe = ncm0->dpe16; while (le16_to_cpu(dpe->wDatagramIndex) != 0 && le16_to_cpu(dpe->wDatagramLength) != 0) { - if (le16_to_cpu(dpe->wDatagramIndex) >= urb->actual_length || + if (le16_to_cpu(dpe->wDatagramIndex) < IPHETH_NCM_HEADER_SIZE || + le16_to_cpu(dpe->wDatagramIndex) >= urb->actual_length || le16_to_cpu(dpe->wDatagramLength) > urb->actual_length - le16_to_cpu(dpe->wDatagramIndex)) { dev->net->stats.rx_length_errors++; |