Re: [PATCH net v2 2/2] net: usb: pegasus: check rx pkt_len against the received length

[Simon Horman]

On Wed, Oct 21, 2026 at 10:03:10AM +0800, Wei Jie Law wrote:
> read_bulk_callback() takes the frame length from the device, from the
> receive header on the 0x8513 and from the trailing status bytes on the
> other chips, and only checks it against PEGASUS_MTU before passing that
> many bytes up the stack. In two cases the stack then uses bytes that the
> device did not send:
> 
> - A device that sends a short transfer but claims a long frame gets the
>   stale or uninitialized remainder of the receive skb delivered as
>   packet data.
> 
> - A device that claims a frame shorter than an Ethernet header gets
>   past the check as well. eth_type_trans() takes pkt_type from h_dest
>   and the protocol from h_proto without checking skb->len. If the
>   transfer is also short, those come from bytes left in the skb by an
>   earlier transfer, or from uninitialized memory.
> 
> Drop frames shorter than ETH_HLEN, and frames whose claimed length, plus
> the 0x8513 header, does not fit in the bytes actually received, and
> count them as length errors. urb->actual_length never exceeds the
> PEGASUS_MTU sized transfer buffer, so this also covers the existing
> PEGASUS_MTU check. Valid Ethernet frames are at least 60 bytes long
> without the FCS, so they are not affected.
> 
> Found by code review with LLM assistance. With an emulated USB device,
> a 101-byte transfer claiming a 1500-byte frame was passed up as a
> 1500-byte packet before this change and is dropped after it, and
> frames claiming 0, 4 and 13 bytes were passed up and are now dropped
> and counted in rx_length_errors. The extra bytes happened to be zero
> in the first test, so disclosure of actual kernel data was not
> demonstrated.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: LLM
> Signed-off-by: Wei Jie Law <law.wei.jie@xxxxxxxxxxxxxx>

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>