lkml.org 
[lkml]   [2021]   [Jul]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.12 620/700] staging: gdm724x: check for buffer overflow in gdm_lte_multi_sdu_pkt()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit 4a36e160856db8a8ddd6a3d2e5db5a850ab87f82 ]

    There needs to be a check to verify that we don't read beyond the end
    of "buf". This function is called from do_rx(). The "buf" is the USB
    transfer_buffer and "len" is "urb->actual_length".

    Fixes: 61e121047645 ("staging: gdm7240: adding LTE USB driver")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Link: https://lore.kernel.org/r/YMcnl4zCwGWGDVMG@mwanda
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/staging/gdm724x/gdm_lte.c | 10 +++++++++-
    1 file changed, 9 insertions(+), 1 deletion(-)

    diff --git a/drivers/staging/gdm724x/gdm_lte.c b/drivers/staging/gdm724x/gdm_lte.c
    index 571f47d39484..a41af7aa74ec 100644
    --- a/drivers/staging/gdm724x/gdm_lte.c
    +++ b/drivers/staging/gdm724x/gdm_lte.c
    @@ -677,6 +677,7 @@ static void gdm_lte_multi_sdu_pkt(struct phy_dev *phy_dev, char *buf, int len)
    struct sdu *sdu = NULL;
    u8 endian = phy_dev->get_endian(phy_dev->priv_dev);
    u8 *data = (u8 *)multi_sdu->data;
    + int copied;
    u16 i = 0;
    u16 num_packet;
    u16 hci_len;
    @@ -688,6 +689,12 @@ static void gdm_lte_multi_sdu_pkt(struct phy_dev *phy_dev, char *buf, int len)
    num_packet = gdm_dev16_to_cpu(endian, multi_sdu->num_packet);

    for (i = 0; i < num_packet; i++) {
    + copied = data - multi_sdu->data;
    + if (len < copied + sizeof(*sdu)) {
    + pr_err("rx prevent buffer overflow");
    + return;
    + }
    +
    sdu = (struct sdu *)data;

    cmd_evt = gdm_dev16_to_cpu(endian, sdu->cmd_evt);
    @@ -698,7 +705,8 @@ static void gdm_lte_multi_sdu_pkt(struct phy_dev *phy_dev, char *buf, int len)
    pr_err("rx sdu wrong hci %04x\n", cmd_evt);
    return;
    }
    - if (hci_len < 12) {
    + if (hci_len < 12 ||
    + len < copied + sizeof(*sdu) + (hci_len - 12)) {
    pr_err("rx sdu invalid len %d\n", hci_len);
    return;
    }
    --
    2.30.2


    \
     
     \ /
      Last update: 2021-07-12 10:10    [W:4.625 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site