mirror of
https://github.com/torvalds/linux.git
synced 2026-05-12 16:18:45 +02:00
0e7c074cfc
t7xx_port_enum_msg_handler() uses the modem-supplied port_count field as
a loop bound over port_msg->data[] without checking that the message buffer
contains sufficient data. A modem sending port_count=65535 in a 12-byte
buffer triggers a slab-out-of-bounds read of up to 262140 bytes.
Add a sizeof(*port_msg) check before accessing the port message header
fields to guard against undersized messages.
Add a struct_size() check after extracting port_count and before the loop.
In t7xx_parse_host_rt_data(), guard the rt_feature header read with a
remaining-buffer check before accessing data_len, validate feat_data_len
against the actual remaining buffer to prevent OOB reads and signed
integer overflow on offset.
Pass msg_len from both call sites: skb->len at the DPMAIF path after
skb_pull(), and the validated feat_data_len at the handshake path.
Fixes:
|
||
|---|---|---|
| .. | ||
| iosm | ||
| t7xx | ||
| Kconfig | ||
| Makefile | ||
| mhi_wwan_ctrl.c | ||
| mhi_wwan_mbim.c | ||
| qcom_bam_dmux.c | ||
| rpmsg_wwan_ctrl.c | ||
| wwan_core.c | ||
| wwan_hwsim.c | ||