Re: [PATCH] net: usb: cx82310_eth: bound partial receive continuation
From: Andrew Lunn <andrew@lunn.ch>
Date: 2026-07-06 15:06:46
Also in:
linux-usb, lkml
On Sun, Jul 05, 2026 at 04:36:09PM +0800, Pengpeng Hou wrote:
cx82310_rx_fixup() completes a packet that started in the previous URB by copying dev->partial_rem bytes from the current skb. It then pulls the same continuation extent, rounded up to an even byte count. The code does not first prove that the current skb contains that continuation. Add a fail-closed bound check before the copy and pull. If the continuation is shorter than the pending packet state expects, drop that pending partial packet before returning so later URBs are not consumed as stale continuation bytes. This keeps the existing cross-URB packet model, but avoids consuming bytes that are not present in the current skb.
Please take a read of: https://www.kernel.org/doc/html/latest/process/maintainer-netdev.html The Subject: line is wrong. How has this been tested?
static int cx82310_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
{
- int len;
+ int len, pull_len;
struct sk_buff *skb2;
struct cx82310_priv *priv = dev->driver_priv;Although the reverse christmas tree is already broken here, you should try to keep with it, and put the new line at the end.
quoted hunk ↗ jump to hunk
@@ -251,6 +251,13 @@ * end of that packet at the beginning. */ if (dev->partial_rem) { + pull_len = (dev->partial_rem + 1) & ~1; + if (skb->len < pull_len) { + dev->partial_len = 0; + dev->partial_rem = 0; + return 0; + } + len = dev->partial_len + dev->partial_rem; skb2 = alloc_skb(len, GFP_ATOMIC); if (!skb2)@@ -261,7 +265,7 @@ memcpy(skb2->data + dev->partial_len, skb->data, dev->partial_rem); usbnet_skb_return(dev, skb2); - skb_pull(skb, (dev->partial_rem + 1) & ~1); + skb_pull(skb, pull_len); dev->partial_rem = 0; if (skb->len < 2) return 1;