Re: [PATCH] net: wwan: t7xx: validate the HS2 message data length
flat view
From: Loic Poulain <loic.poulain@oss.qualcomm.com>
Date: 2026-09-09 13:10:57
Also in:
lkml, stable
On Wed, Sep 9, 2026 at 7:44 AM Guanglei Zhu [off-list ref] wrote:
control_msg_handler() passes the modem-supplied data_length field of a
CTL_ID_HS2_MSG message straight to t7xx_fsm_append_event(), which
memcpy()s that many bytes out of the skb. Nothing compares the field
with the actual length of the message, so a modem reporting a larger
data_length makes the driver read past the end of the skb and store
kernel heap memory in the FSM event.
0e7c074cfcd9 ("net: wwan: t7xx: validate port_count against message
length in t7xx_port_enum_msg_handler") added this kind of check for
the port enumeration path but missed the handshake path.
Reject the message when data_length does not fit into the skb.
Fixes: da45d2566a1d ("net: wwan: t7xx: Add control port")
Cc: stable@vger.kernel.org
Signed-off-by: Guanglei Zhu <redacted>Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
quoted hunk ↗ jump to hunk
--- Verified in a QEMU guest with a fault injector feeding the driver's control port thread a handshake message whose data_length exceeds the skb: the unpatched driver trips KASAN on a read of 8192 bytes past a 500-byte payload, and the extra bytes land in the FSM event. With this check the message is rejected, and well-formed handshakes are unaffected. drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)diff --git a/drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c b/drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c index f869e4ed9..0f2ead8a7 100644 --- a/drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c +++ b/drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c@@ -178,22 +178,32 @@ static int control_msg_handler(struct t7xx_port *port, struct sk_buff *skb) ctrl_msg_h = (struct ctrl_msg_header *)skb->data; switch (le32_to_cpu(ctrl_msg_h->ctrl_msg_id)) { - case CTL_ID_HS2_MSG: + case CTL_ID_HS2_MSG: { + u32 data_length; + skb_pull(skb, sizeof(*ctrl_msg_h)); + data_length = le32_to_cpu(ctrl_msg_h->data_length); if (port_conf->rx_ch == PORT_CH_CONTROL_RX || port_conf->rx_ch == PORT_CH_AP_CONTROL_RX) { int event = port_conf->rx_ch == PORT_CH_CONTROL_RX ? FSM_EVENT_MD_HS2 : FSM_EVENT_AP_HS2; - ret = t7xx_fsm_append_event(ctl, event, skb->data, - le32_to_cpu(ctrl_msg_h->data_length)); - if (ret) - dev_err(port->dev, "Failed to append Handshake 2 event"); + if (data_length > skb->len) { + dev_err(port->dev, "Invalid HS2 message length %u\n", + data_length); + ret = -EINVAL; + } else { + ret = t7xx_fsm_append_event(ctl, event, skb->data, + data_length); + if (ret) + dev_err(port->dev, "Failed to append Handshake 2 event"); + } } dev_kfree_skb_any(skb); break; + } case CTL_ID_MD_EX: case CTL_ID_MD_EX_ACK: --2.43.0