Commit 8a11ff09 authored by Junrui Luo's avatar Junrui Luo Committed by Jakub Kicinski
Browse files

caif: fix integer underflow in cffrml_receive() 



The cffrml_receive() function extracts a length field from the packet
header and, when FCS is disabled, subtracts 2 from this length without
validating that len >= 2.

If an attacker sends a malicious packet with a length field of 0 or 1
to an interface with FCS disabled, the subtraction causes an integer
underflow.

This can lead to memory exhaustion and kernel instability, potential
information disclosure if padding contains uninitialized kernel memory.

Fix this by validating that len >= 2 before performing the subtraction.

Reported-by: default avatarYuhao Jiang <danisjiang@gmail.com>
Reported-by: default avatarJunrui Luo <moonafterrain@outlook.com>
Fixes: b482cd20 ("net-caif: add CAIF core protocol stack")
Signed-off-by: default avatarJunrui Luo <moonafterrain@outlook.com>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Link: https://patch.msgid.link/SYBPR01MB7881511122BAFEA8212A1608AFA6A@SYBPR01MB7881.ausprd01.prod.outlook.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 71cfa7c8

net/caif/cffrml.c

+8 −1
Original line number Diff line number Diff line
@@ -92,8 +92,15 @@ static int cffrml_receive(struct cflayer *layr, struct cfpkt *pkt) 
	len = le16_to_cpu(tmp);



	/* Subtract for FCS on length if FCS is not used. */

	if (!this->dofcs)

	if (!this->dofcs) {

		if (len < 2) {

			++cffrml_rcv_error;

			pr_err("Invalid frame length (%d)\n", len);

			cfpkt_destroy(pkt);

			return -EPROTO;

		}

		len -= 2;

	}



	if (cfpkt_setlen(pkt, len) < 0) {

		++cffrml_rcv_error;