[RFC] aqc111: check for valid header length before parsing
From: Oliver Neukum <oneukum@suse.com>
Date: 2022-02-15 11:02:49
Also in:
linux-usb
Subsystem:
networking drivers, the rest, usb networking drivers · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
The received package must be checked for being long enough to contain the header to be parsed, or garbage may be parsed during fixup. Signed-off-by: Oliver Neukum <oneukum@suse.com> --- drivers/net/usb/aqc111.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c
index ea06d10e1c21..7848fe941a36 100644
--- a/drivers/net/usb/aqc111.c
+++ b/drivers/net/usb/aqc111.c@@ -1084,10 +1084,10 @@ static int aqc111_rx_fixup(struct usbnet *dev, struct sk_buff *skb) if (!skb) goto err; - if (skb->len == 0) + skb_len = skb->len; + if (skb_len < sizeof(desc_hdr)) goto err; - skb_len = skb->len; /* RX Descriptor Header */ skb_trim(skb, skb->len - sizeof(desc_hdr)); desc_hdr = le64_to_cpup((u64 *)skb_tail_pointer(skb));
--
2.34.1