Commit ee591f2b authored by Foster Snowhill's avatar Foster Snowhill Committed by Paolo Abeni
Browse files

usbnet: ipheth: fix DPE OoB read 



Fix an out-of-bounds DPE read, limit the number of processed DPEs to
the amount that fits into the fixed-size NDP16 header.

Fixes: a2d274c6 ("usbnet: ipheth: add CDC NCM support")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarFoster Snowhill <forst@pen.gy>
Reviewed-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parent efcbc678

drivers/net/usb/ipheth.c

+1 −3
Original line number Diff line number Diff line
@@ -246,7 +246,7 @@ static int ipheth_rcvbulk_callback_ncm(struct urb *urb) 
		goto rx_error;



	dpe = ncm0->dpe16;

	while (true) {

	for (int dpe_i = 0; dpe_i < IPHETH_NDP16_MAX_DPE; ++dpe_i, ++dpe) {

		dg_idx = le16_to_cpu(dpe->wDatagramIndex);

		dg_len = le16_to_cpu(dpe->wDatagramLength);
@@ -268,8 +268,6 @@ static int ipheth_rcvbulk_callback_ncm(struct urb *urb) 
		retval = ipheth_consume_skb(buf, dg_len, dev);

		if (retval != 0)

			return retval;



		dpe++;

	}



rx_error: