diff mbox series

[5.16,027/164] sr9700: sanity check for packet length

Message ID	20220228172402.604694515@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Oliver Neukum <oneukum@suse.com>, Grant Grundler <grundler@chromium.org>, "David S. Miller" <davem@davemloft.net> Subject: [PATCH 5.16 027/164] sr9700: sanity check for packet length Date: Mon, 28 Feb 2022 18:23:09 +0100 Message-Id: <20220228172402.604694515@linuxfoundation.org> In-Reply-To: <20220228172359.567256961@linuxfoundation.org> References: <20220228172359.567256961@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.16,003/164] cgroup-v1: Correct privileges check in release_agent writes [5.16,005/164] btrfs: tree-checker: check item_size for dev_item [5.16,006/164] slab: remove __alloc_size attribute from __kmalloc_track_caller [5.16,010/164] selinux: fix misuse of mutex_is_locked() [5.16,011/164] vhost/vsock: dont check owner in vhost_vsock_stop() while releasing [5.16,014/164] KVM: x86/mmu: make apf token non-zero to fix bug [5.16,015/164] KVM: x86: nSVM: disallow userspace setting of MSR_AMD64_TSC_RATIO to non default v... [5.16,017/164] drm/amd/display: Protect update_bw_bounding_box FPU code. [5.16,021/164] drm/amdgpu: do not enable asic reset for raven2 [5.16,022/164] drm/amdgpu: check vm ready by amdgpu_vm->evicting flag [5.16,024/164] drm/i915: Disconnect PHYs left connected by BIOS on disabled ports [5.16,026/164] drm/i915: Fix bw atomic check when switching between SAGV vs. no SAGV [5.16,027/164] sr9700: sanity check for packet length [5.16,028/164] USB: zaurus: support another broken Zaurus [5.16,029/164] CDC-NCM: avoid overflow in sanity checking [5.16,031/164] netfilter: xt_socket: missing ifdef CONFIG_IP6_NF_IPTABLES dependency [5.16,032/164] netfilter: nf_tables_offload: incorrect flow offload action array size [5.16,035/164] gpu: host1x: Always return syncpoint value when waiting [5.16,036/164] perf evlist: Fix failed to use cpu list for uncore events [5.16,037/164] perf data: Fix double free in perf_session__delete() [5.16,038/164] mptcp: fix race in incoming ADD_ADDR option processing [5.16,040/164] selftests: mptcp: fix diag instability [5.16,043/164] bnxt_en: Fix devlink fw_activate [5.16,046/164] bnxt_en: Fix occasional ethtool -t loopback test failures [5.16,047/164] bnxt_en: Fix incorrect multicast rx mask setting when not requested [5.16,048/164] bnxt_en: Restore the resets_reliable flag in bnxt_open() [5.16,049/164] hwmon: Handle failure to register sensor with thermal zone correctly [5.16,051/164] ice: fix setting l4 port flag when adding filter [5.16,052/164] ice: fix concurrent reset and removal of VFs [5.16,056/164] bpf: Fix crash due to incorrect copy_map_value [5.16,061/164] io_uring: add a schedule point in io_add_buffers() [5.16,064/164] tipc: Fix end of loop tests for list_for_each_entry() [5.16,065/164] clk: qcom: gcc-msm8994: Remove NoC clocks [5.16,068/164] openvswitch: Fix setting ipv6 fields causing hw csum failure [5.16,069/164] drm/edid: Always set RGB444 [5.16,072/164] net/mlx5e: TC, Reject rules with drop and modify hdr action [5.16,073/164] block: clear iocb->private in blkdev_bio_end_io_async() [5.16,076/164] drm/amd/display: For vblank_disable_immediate, check PSR is really used [5.16,078/164] net: ll_temac: check the return value of devm_kmalloc() [5.16,079/164] net: Force inlining of checksum functions in net/checksum.h [5.16,082/164] nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac() [5.16,083/164] net: mdio-ipq4019: add delay after clock enable [5.16,084/164] netfilter: nf_tables: fix memory leak during stateful obj update [5.16,086/164] surface: surface3_power: Fix battery readings on batteries without a serial number [5.16,087/164] udp_tunnel: Fix end of loop test in udp_tunnel_nic_unregister() [5.16,089/164] ibmvnic: schedule failover only if vioctl fails [5.16,091/164] net/mlx5: Fix possible deadlock on rule deletion [5.16,092/164] net/mlx5: Fix wrong limitation of metadata match on ecpf [5.16,093/164] net/mlx5: DR, Fix the threshold that defines when pool sync is initiated [5.16,096/164] net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte [5.16,097/164] net/mlx5: Update log_max_qp value to be 17 at most [5.16,099/164] spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op() [5.16,101/164] gpio: rockchip: Reset int_bothedge when changing trigger [5.16,103/164] net: use sk_is_tcp() in more places [5.16,104/164] net-timestamp: convert sk->sk_tskey to atomic_t [5.16,109/164] RDMA/ib_srp: Fix a deadlock [5.16,110/164] bpf: Extend kfunc with PTR_TO_CTX, PTR_TO_MEM argument support [5.16,111/164] bpf: Fix crash due to out of bounds access into reg2btf_ids. [5.16,112/164] tracing: Dump stacktrace trigger to the corresponding instance [5.16,116/164] iio: adc: tsc2046: fix memory corruption by preventing array overflow [5.16,119/164] iio: imu: st_lsm6dsx: wait for settling time in st_lsm6dsx_read_oneshot [5.16,122/164] ata: pata_hpt37x: disable primary channel on HPT371 [5.16,123/164] Revert "USB: serial: ch341: add new Product ID for CH341A" [5.16,126/164] tracefs: Set the group ownership in apply_options() not parse_options() [5.16,128/164] USB: serial: option: add Telit LE910R1 compositions [5.16,129/164] usb: dwc2: drd: fix soft connect when gadget is unconfigured [5.16,132/164] usb: dwc3: gadget: Let the interrupt handler disable bottom halves. [5.16,133/164] xhci: re-initialize the HC during resume if HCE was set [5.16,135/164] nvmem: core: Fix a conflict between MTD and NVMEM on wp-gpios property [5.16,136/164] mtd: core: Fix a conflict between MTD and NVMEM on wp-gpios property [5.16,138/164] btrfs: defrag: dont try to merge regular extents with preallocated extents [5.16,140/164] btrfs: defrag: remove an ambiguous condition for rejection [5.16,141/164] btrfs: prevent copying too big compressed lzo segment [5.16,142/164] btrfs: defrag: allow defrag_one_cluster() to skip large extent which is not a target [5.16,147/164] staging: fbtft: fb_st7789v: reset display before initialization [5.16,150/164] riscv: fix nommu_k210_sdcard_defconfig [5.16,153/164] hugetlbfs: fix a truncation issue in hugepages parameter [5.16,155/164] tty: n_gsm: fix encoding of command/response bit [5.16,156/164] tty: n_gsm: fix proper link termination after failed open [5.16,157/164] tty: n_gsm: fix NULL pointer access due to DLCI release [5.16,159/164] tty: n_gsm: fix wrong modem processing in convergence layer type 2 [5.16,160/164] tty: n_gsm: fix deadlock in gsmtty_open() [5.16,162/164] pinctrl: k210: Fix bias-pull-up [5.16,164/164] memblock: use kfree() to release kmalloced memblock regions

Commit Message

Greg KH Feb. 28, 2022, 5:23 p.m. UTC

From: Oliver Neukum <oneukum@suse.com>

commit e9da0b56fe27206b49f39805f7dcda8a89379062 upstream.

A malicious device can leak heap data to user space
providing bogus frame lengths. Introduce a sanity check.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reviewed-by: Grant Grundler <grundler@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/sr9700.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff mbox series

Patch

--- a/drivers/net/usb/sr9700.c
+++ b/drivers/net/usb/sr9700.c
@@ -413,7 +413,7 @@  static int sr9700_rx_fixup(struct usbnet
 		/* ignore the CRC length */
 		len = (skb->data[1] | (skb->data[2] << 8)) - 4;
 
-		if (len > ETH_FRAME_LEN)
+		if (len > ETH_FRAME_LEN || len > skb->len)
 			return 0;
 
 		/* the last packet of current skb */