netdev - Re: [PATCH 2/3] rndis_host: enable the bogus MAC fixup for ZTE devices from cdc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87o81d1kay.fsf@miraculix.mork.no>
Date:   Thu, 07 Apr 2022 08:25:57 +0200
From:   Bjørn Mork <bjorn@...k.no>
To:     Lech Perczak <lech.perczak@...il.com>
Cc:     netdev@...r.kernel.org, linux-usb@...r.kernel.org,
        Kristian Evensen <kristian.evensen@...il.com>,
        Oliver Neukum <oliver@...kum.org>
Subject: Re: [PATCH 2/3] rndis_host: enable the bogus MAC fixup for ZTE
 devices from cdc_ether

Lech Perczak <lech.perczak@...il.com> writes:

> +static int zte_rndis_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
> +{
> +	return rndis_rx_fixup(dev, skb) && usbnet_cdc_zte_rx_fixup(dev, skb);
> +}
>  

Does this work as expected? Only the last ethernet packet in the rndis
frame will end up being handled by usbnet_cdc_zte_rx_fixup().  The
others are cloned and submitted directly to usbnet_skb_return().

I don't know how to best solve that, but maybe add another
RNDIS_DRIVER_DATA_x flag and test that in rndis_rx_fixup?  I.e something
like

	bool fixup_dst = dev->driver_info->data & RNDIS_DRIVER_DATA_FIXUP_DST:
        ..

		/* try to return all the packets in the batch */
		skb2 = skb_clone(skb, GFP_ATOMIC);
		if (unlikely(!skb2))
			break;
		skb_pull(skb, msg_len - sizeof *hdr);
		skb_trim(skb2, data_len);
                if (fixup_dst)
                	usbnet_cdc_zte_rx_fixup(dev, skb2);
		usbnet_skb_return(dev, skb2);
	}
        if (fixup_dst)
                usbnet_cdc_zte_rx_fixup(dev, skb);

	/* caller will usbnet_skb_return the remaining packet */
	return 1;
}



Bjørn