netdev - Re: [PATCHv2] USB: gl620a: check for rx buffer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 5 Dec 2023 11:21:54 +0100
From: Oliver Neukum <oneukum@...e.com>
To: Paolo Abeni <pabeni@...hat.com>, Oliver Neukum <oneukum@...e.com>,
 dmitry.bezrukov@...antia.com, marcinguy@...il.com, davem@...emloft.net,
 edumazet@...gle.com, kuba@...nel.org, linux-usb@...r.kernel.org,
 netdev@...r.kernel.org
Subject: Re: [PATCHv2] USB: gl620a: check for rx buffer overflow



On 05.12.23 09:04, Paolo Abeni wrote:

Hi,

> I think the above is not strict enough: at this point skb->data points
> to the gl_packet header. The first 4 bytes in skb are gl_packet-
>> packet_length. To ensure an overflow is avoided you should check for:
> 
> 		if (size + 4 > skb->len)
> 
> likely with a describing comment.

it seems to me that at the time of the check skb->len has already
been adjusted by the skb_pull() before, respectively at the end, of
the loop.

	Regards
		Oliver