[PATCH net] net: usb: net1080: validate packet_len before pad-byte access in rx_fixup

[Xiang Mei]

net1080_rx_fixup() only bounds the device-supplied packet_len against
NC_MAX_PACKET. When packet_len is even it reads skb->data[packet_len] to
check the pad byte, before the skb->len != packet_len check further down.

A malicious NetChip 1080 device can send a short frame advertising a
large even packet_len (e.g. 0x4000), so the pad-byte read lands past the
end of the skb:

  BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup
  Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14
   ...
   net1080_rx_fixup (drivers/net/usb/net1080.c:384)
   usbnet_bh (drivers/net/usb/usbnet.c:1589)
   process_one_work (kernel/workqueue.c:3322)
   bh_worker (kernel/workqueue.c:3708)
   tasklet_action (kernel/softirq.c:965)
   handle_softirqs (kernel/softirq.c:622)
   ...

Reject the frame if packet_len leaves no room for the pad byte. Valid
even-length frames carry one pad byte (skb->len == packet_len + 1), so
legitimate traffic is unaffected.

Fixes: 904813cd8a0b ("[PATCH] USB: usbnet (4/9) module for net1080 cables")
Reported-by: Weiming Shi <bestswngs@xxxxxxxxx>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@xxxxxxx>
---
 drivers/net/usb/net1080.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/usb/net1080.c b/drivers/net/usb/net1080.c
index 5d4a1fd2b524..364c19bd822f 100644
--- a/drivers/net/usb/net1080.c
+++ b/drivers/net/usb/net1080.c
@@ -381,6 +381,13 @@ static int net1080_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 	skb_trim(skb, skb->len - sizeof *trailer);
 
 	if ((packet_len & 0x01) == 0) {
+		if (packet_len >= skb->len) {
+			dev->net->stats.rx_frame_errors++;
+			netdev_dbg(dev->net, "bad packet len %d (expected %d)\n",
+				   skb->len, packet_len);
+			nc_ensure_sync(dev);
+			return 0;
+		}
 		if (skb->data [packet_len] != PAD_BYTE) {
 			dev->net->stats.rx_frame_errors++;
 			netdev_dbg(dev->net, "bad pad\n");
-- 
2.43.0