]> git.baikalelectronics.ru Git - kernel.git/commit
net: usb: smsc95xx: Limit packet length to skb->len
authorSzymon Heidrich <szymon.heidrich@gmail.com>
Thu, 16 Mar 2023 10:19:54 +0000 (11:19 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 5 Apr 2023 09:16:37 +0000 (11:16 +0200)
commitcb2c95dca2426fa24728195830abb453050c4773
treef206f4f7e93cd1d8ac039633954c2c87678cb6a9
parentb57e8b369255f29c4d3544ed5c5329151c3d2ba6
net: usb: smsc95xx: Limit packet length to skb->len

[ Upstream commit ff821092cf02a70c2bccd2d19269f01e29aa52cf ]

Packet length retrieved from descriptor may be larger than
the actual socket buffer length. In such case the cloned
skb passed up the network stack will leak kernel memory contents.

Fixes: b9e480c376c5 ("net: Add SMSC LAN9500 USB2.0 10/100 ethernet adapter driver")
Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Link: https://lore.kernel.org/r/20230316101954.75836-1-szymon.heidrich@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/usb/smsc95xx.c