diff options
| author |   Foster Snowhill <forst@pen.gy> | 2025-01-26 00:54:03 +0100 |
|---|---|---|
| committer |   Paolo Abeni <pabeni@redhat.com> | 2025-01-28 12:16:32 +0100 |
| commit | c219427ed296f94bb4b91d08626776dc7719ee27 (patch) | |
| tree | a5f952016643e1a57dad9c8500671a85b4eb4502 | |
| parent | ptp: Properly handle compat ioctls (diff) | |
| download | wireguard-linux-c219427ed296f94bb4b91d08626776dc7719ee27.tar.xz wireguard-linux-c219427ed296f94bb4b91d08626776dc7719ee27.zip | |
usbnet: ipheth: fix possible overflow in DPE length check
Originally, it was possible for the DPE length check to overflow if
wDatagramIndex + wDatagramLength > U16_MAX. This could lead to an OoB
read.
Move the wDatagramIndex term to the other side of the inequality.
An existing condition ensures that wDatagramIndex < urb->actual_length.
Fixes: a2d274c62e44 ("usbnet: ipheth: add CDC NCM support")
Cc: stable@vger.kernel.org
Signed-off-by: Foster Snowhill <forst@pen.gy>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
| -rw-r--r-- | drivers/net/usb/ipheth.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c index 46afb95ffabe..45daae234cb8 100644 --- a/drivers/net/usb/ipheth.c +++ b/drivers/net/usb/ipheth.c @@ -243,8 +243,8 @@ static int ipheth_rcvbulk_callback_ncm(struct urb *urb) while (le16_to_cpu(dpe->wDatagramIndex) != 0 && le16_to_cpu(dpe->wDatagramLength) != 0) { if (le16_to_cpu(dpe->wDatagramIndex) >= urb->actual_length || - le16_to_cpu(dpe->wDatagramIndex) + - le16_to_cpu(dpe->wDatagramLength) > urb->actual_length) { + le16_to_cpu(dpe->wDatagramLength) > urb->actual_length - + le16_to_cpu(dpe->wDatagramIndex)) { dev->net->stats.rx_length_errors++; return retval; } |