| Message ID | 20220215110243.30468-1-oneukum@suse.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [RFC] aqc111: check for valid header length before parsing | expand |
diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c index ea06d10e1c21..7848fe941a36 100644 --- a/drivers/net/usb/aqc111.c +++ b/drivers/net/usb/aqc111.c @@ -1084,10 +1084,10 @@ static int aqc111_rx_fixup(struct usbnet *dev, struct sk_buff *skb) if (!skb) goto err; - if (skb->len == 0) + skb_len = skb->len; + if (skb_len < sizeof(desc_hdr)) goto err; - skb_len = skb->len; /* RX Descriptor Header */ skb_trim(skb, skb->len - sizeof(desc_hdr)); desc_hdr = le64_to_cpup((u64 *)skb_tail_pointer(skb));
The received package must be checked for being long enough to contain the header to be parsed, or garbage may be parsed during fixup. Signed-off-by: Oliver Neukum <oneukum@suse.com> --- drivers/net/usb/aqc111.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)