mirror of
https://github.com/torvalds/linux.git
synced 2026-06-05 04:56:13 +02:00
0e7c074cfc
t7xx_port_enum_msg_handler() uses the modem-supplied port_count field as
a loop bound over port_msg->data[] without checking that the message buffer
contains sufficient data. A modem sending port_count=65535 in a 12-byte
buffer triggers a slab-out-of-bounds read of up to 262140 bytes.
Add a sizeof(*port_msg) check before accessing the port message header
fields to guard against undersized messages.
Add a struct_size() check after extracting port_count and before the loop.
In t7xx_parse_host_rt_data(), guard the rt_feature header read with a
remaining-buffer check before accessing data_len, validate feat_data_len
against the actual remaining buffer to prevent OOB reads and signed
integer overflow on offset.
Pass msg_len from both call sites: skb->len at the DPMAIF path after
skb_pull(), and the validated feat_data_len at the handshake path.
Fixes:
|
||
|---|---|---|
| .. | ||
| Makefile | ||
| t7xx_cldma.c | ||
| t7xx_cldma.h | ||
| t7xx_dpmaif.c | ||
| t7xx_dpmaif.h | ||
| t7xx_hif_cldma.c | ||
| t7xx_hif_cldma.h | ||
| t7xx_hif_dpmaif_rx.c | ||
| t7xx_hif_dpmaif_rx.h | ||
| t7xx_hif_dpmaif_tx.c | ||
| t7xx_hif_dpmaif_tx.h | ||
| t7xx_hif_dpmaif.c | ||
| t7xx_hif_dpmaif.h | ||
| t7xx_mhccif.c | ||
| t7xx_mhccif.h | ||
| t7xx_modem_ops.c | ||
| t7xx_modem_ops.h | ||
| t7xx_netdev.c | ||
| t7xx_netdev.h | ||
| t7xx_pci.c | ||
| t7xx_pci.h | ||
| t7xx_pcie_mac.c | ||
| t7xx_pcie_mac.h | ||
| t7xx_port_ctrl_msg.c | ||
| t7xx_port_proxy.c | ||
| t7xx_port_proxy.h | ||
| t7xx_port_trace.c | ||
| t7xx_port_wwan.c | ||
| t7xx_port.h | ||
| t7xx_reg.h | ||
| t7xx_state_monitor.c | ||
| t7xx_state_monitor.h | ||