Skip to contentSkip to conversation

rndis_host: add overflow check in rndis_rx_fixup()

PATCH Applied Greg Kroah-Hartman 3 participants 3 messages Jul 9 – Jul 21

Subsystems (4)
Networking Network drivers USB USB networking drivers
lore
Share & tools
lore

Greg Kroah-Hartman

author maintainer
#0 lore raw

PATCH 1/1 rndis_host: add overflow check in rndis_rx_fixup()

From: Griffin Kroah-Hartman <[email protected]>

Add an overflow check to ensure that data_offset + data_len + 8 does not wrap, which would enable an OOB read of the USB data buffer.

Assisted-by gkh_clanker_1000
Cc Andrew Lunn <[email protected]>
Cc "David S. Miller" <[email protected]>
Cc Eric Dumazet <[email protected]>
Cc Jakub Kicinski <[email protected]>
Cc Paolo Abeni <[email protected]>
Cc Shaoxu Liu <[email protected]>
Signed-off-by Griffin Kroah-Hartman <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/net/usb/rndis_host.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/usb/rndis_host.c +5 -1
index 5e39d05a2d7b..37d4865f5c5e 100644
@@ -14,6 +14,7 @@
 #include <linux/usb/cdc.h>
 #include <linux/usb/usbnet.h>
 #include <linux/usb/rndis_host.h>
+#include <linux/overflow.h>
 
 
 /*

@@ -506,6 +507,7 @@ int rndis_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 		struct rndis_data_hdr	*hdr = (void *)skb->data;
 		struct sk_buff		*skb2;
 		u32			msg_type, msg_len, data_offset, data_len;
+		u32			overflow_check;
 
 		msg_type = le32_to_cpu(hdr->msg_type);
 		msg_len = le32_to_cpu(hdr->msg_len);

@@ -514,7 +516,9 @@ int rndis_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 
 		/* don't choke if we see oob, per-packet data, etc */
 		if (unlikely(msg_type != RNDIS_MSG_PACKET || skb->len < msg_len
-				|| (data_offset + data_len + 8) > msg_len)) {
+				|| (data_offset + data_len + 8) > msg_len
+				|| check_add_overflow(data_offset, data_len, &overflow_check)
+				|| check_add_overflow(overflow_check, 8, &overflow_check))) {
 			dev->net->stats.rx_frame_errors++;
 			netdev_dbg(dev->net, "bad rndis message %d/%d/%d/%d, len %d\n",
 				   le32_to_cpu(hdr->msg_type),
Signature · 1 line
2.55.0
reviewer Reviewed-by on v1 1/1
#1 lore raw
Quoted 5 lines · Greg Kroah-Hartman

From: Griffin Kroah-Hartman <[email protected]>

Add an overflow check to ensure that data_offset + data_len + 8 does not wrap, which would enable an OOB read of the USB data buffer.

Quoted 9 lines
Assisted-by gkh_clanker_1000
Cc Andrew Lunn <[email protected]>
Cc "David S. Miller" <[email protected]>
Cc Eric Dumazet <[email protected]>
Cc Jakub Kicinski <[email protected]>
Cc Paolo Abeni <[email protected]>
Cc Shaoxu Liu <[email protected]>
Signed-off-by Griffin Kroah-Hartman <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
Reviewed-by Simon Horman <[email protected]>
CI Applied
#2 lore raw
In reply to Greg Kroah-Hartman
This patch was applied to netdev/net-next.git (main) by Jakub Kicinski <[email protected]>:

Hello:

This patch was applied to netdev/net-next.git (main) by Jakub Kicinski <[email protected]>:

Quoted 15 lines · On Thu, 9 Jul 2026 14:24:01 +0200 you wrote:

From: Griffin Kroah-Hartman <[email protected]>

Add an overflow check to ensure that data_offset + data_len + 8 does not wrap, which would enable an OOB read of the USB data buffer.

Assisted-by gkh_clanker_1000
Cc Andrew Lunn <[email protected]>
Cc "David S. Miller" <[email protected]>
Cc Eric Dumazet <[email protected]>
Cc Jakub Kicinski <[email protected]>
Cc Paolo Abeni <[email protected]>
Cc Shaoxu Liu <[email protected]>
Signed-off-by Griffin Kroah-Hartman <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
Quoted 1 line

[...]

Here is the summary with links:
- [net-next] rndis_host: add overflow check in rndis_rx_fixup()

    https://git.kernel.org/netdev/net-next/c/965a251f23ff

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html