|
Jiri Slaby |
6dd221 |
From: Oliver Neukum <oneukum@suse.com>
|
|
Jiri Slaby |
6dd221 |
Date: Thu, 7 Nov 2019 09:48:01 +0100
|
|
Jiri Slaby |
6dd221 |
Subject: CDC-NCM: handle incomplete transfer of MTU
|
|
Jiri Slaby |
6dd221 |
Git-commit: 332f989a3b0041b810836c5c3747e59aad7e9d0b
|
|
Jiri Slaby |
6dd221 |
Patch-mainline: 5.4-rc7
|
|
Jiri Slaby |
6dd221 |
References: networking-stable-19_11_10
|
|
Jiri Slaby |
6dd221 |
|
|
Jiri Slaby |
6dd221 |
A malicious device may give half an answer when asked
|
|
Jiri Slaby |
6dd221 |
for its MTU. The driver will proceed after this with
|
|
Jiri Slaby |
6dd221 |
a garbage MTU. Anything but a complete answer must be treated
|
|
Jiri Slaby |
6dd221 |
as an error.
|
|
Jiri Slaby |
6dd221 |
|
|
Jiri Slaby |
6dd221 |
V2: used sizeof as request by Alexander
|
|
Jiri Slaby |
6dd221 |
|
|
Jiri Slaby |
6dd221 |
Reported-and-tested-by: syzbot+0631d878823ce2411636@syzkaller.appspotmail.com
|
|
Jiri Slaby |
6dd221 |
Signed-off-by: Oliver Neukum <oneukum@suse.com>
|
|
Jiri Slaby |
6dd221 |
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
Jiri Slaby |
6dd221 |
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
|
|
Jiri Slaby |
6dd221 |
---
|
|
Jiri Slaby |
6dd221 |
drivers/net/usb/cdc_ncm.c | 6 +++---
|
|
Jiri Slaby |
6dd221 |
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
Jiri Slaby |
6dd221 |
|
|
Jiri Slaby |
6dd221 |
--- a/drivers/net/usb/cdc_ncm.c
|
|
Jiri Slaby |
6dd221 |
+++ b/drivers/net/usb/cdc_ncm.c
|
|
Jiri Slaby |
6dd221 |
@@ -576,8 +576,8 @@ static void cdc_ncm_set_dgram_size(struc
|
|
Jiri Slaby |
6dd221 |
/* read current mtu value from device */
|
|
Jiri Slaby |
6dd221 |
err = usbnet_read_cmd(dev, USB_CDC_GET_MAX_DATAGRAM_SIZE,
|
|
Jiri Slaby |
6dd221 |
USB_TYPE_CLASS | USB_DIR_IN | USB_RECIP_INTERFACE,
|
|
Jiri Slaby |
6dd221 |
- 0, iface_no, &max_datagram_size, 2);
|
|
Jiri Slaby |
6dd221 |
- if (err < 0) {
|
|
Jiri Slaby |
6dd221 |
+ 0, iface_no, &max_datagram_size, sizeof(max_datagram_size));
|
|
Jiri Slaby |
6dd221 |
+ if (err < sizeof(max_datagram_size)) {
|
|
Jiri Slaby |
6dd221 |
dev_dbg(&dev->intf->dev, "GET_MAX_DATAGRAM_SIZE failed\n");
|
|
Jiri Slaby |
6dd221 |
goto out;
|
|
Jiri Slaby |
6dd221 |
}
|
|
Jiri Slaby |
6dd221 |
@@ -588,7 +588,7 @@ static void cdc_ncm_set_dgram_size(struc
|
|
Jiri Slaby |
6dd221 |
max_datagram_size = cpu_to_le16(ctx->max_datagram_size);
|
|
Jiri Slaby |
6dd221 |
err = usbnet_write_cmd(dev, USB_CDC_SET_MAX_DATAGRAM_SIZE,
|
|
Jiri Slaby |
6dd221 |
USB_TYPE_CLASS | USB_DIR_OUT | USB_RECIP_INTERFACE,
|
|
Jiri Slaby |
6dd221 |
- 0, iface_no, &max_datagram_size, 2);
|
|
Jiri Slaby |
6dd221 |
+ 0, iface_no, &max_datagram_size, sizeof(max_datagram_size));
|
|
Jiri Slaby |
6dd221 |
if (err < 0)
|
|
Jiri Slaby |
6dd221 |
dev_dbg(&dev->intf->dev, "SET_MAX_DATAGRAM_SIZE failed\n");
|
|
Jiri Slaby |
6dd221 |
|