]> git.baikalelectronics.ru Git - kernel.git/commit
net: usb: smsc95xx: Limit packet length to skb->len
authorSzymon Heidrich <szymon.heidrich@gmail.com>
Thu, 16 Mar 2023 10:19:54 +0000 (11:19 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 5 Apr 2023 09:16:37 +0000 (11:16 +0200)
commit3ef2ffe5b9d8bb958756580a326717441280d16f
treef206f4f7e93cd1d8ac039633954c2c87678cb6a9
parente8d90fcaca53bae96e15e3c3d1a2fdc5f3a23420
net: usb: smsc95xx: Limit packet length to skb->len

[ Upstream commit ff821092cf02a70c2bccd2d19269f01e29aa52cf ]

Packet length retrieved from descriptor may be larger than
the actual socket buffer length. In such case the cloned
skb passed up the network stack will leak kernel memory contents.

Fixes: b9e480c376c5 ("net: Add SMSC LAN9500 USB2.0 10/100 ethernet adapter driver")
Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Link: https://lore.kernel.org/r/20230316101954.75836-1-szymon.heidrich@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/usb/smsc95xx.c