Re: [PATCH] net: usb: sr9700: validate receive packet extent

[Ethan Nelson-Moore]

On Sun, Jul 5, 2026 at 1:37 AM Pengpeng Hou <pengpeng@xxxxxxxxxxx> wrote:
>
> sr9700_rx_fixup() copies len bytes from skb->data + SR_RX_OVERHEAD when
> a URB contains multiple packets. The old check compared len against
> skb->len, but the source pointer has already skipped SR_RX_OVERHEAD
> bytes.
>
> Validate len against the remaining bytes after SR_RX_OVERHEAD before the
> copy and cursor advance.
>
> Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
> ---
> diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
> --- a/drivers/net/usb/sr9700.c
> +++ b/drivers/net/usb/sr9700.c
> @@ -355,7 +355,8 @@
>                 /* ignore the CRC length */
>                 len = (skb->data[1] | (skb->data[2] << 8)) - 4;
>
> -               if (len > ETH_FRAME_LEN || len > skb->len || len < 0)
> +               if (len > ETH_FRAME_LEN || len < 0 ||
> +                   len > skb->len - SR_RX_OVERHEAD)
>                         return 0;
>
>                 /* the last packet of current skb */
>

Hi, Pengpeng,

Other than the subject needing to be clarified, as Andrew mentioned,
the patch looks good to me. Thank you for noticing this issue.

Reviewed-by: Ethan Nelson-Moore <enelsonmoore@xxxxxxxxx>
Tested-by: Ethan Nelson-Moore <enelsonmoore@xxxxxxxxx>

Ethan