[PATCH] net: usb: cx82310_eth: validate skb length in partial packet reassembly

[Aamir Ahmed]

cx82310_rx_fixup() saves partially received packets and attempts to
complete them with data from the next USB transfer. However, it does not
check that the new skb contains enough data to supply the remaining
bytes (dev->partial_rem). The memcpy at the reassembly site blindly
copies partial_rem bytes from skb->data, which can read beyond the skb
data buffer when a malicious or malfunctioning USB device sends a
transfer shorter than expected.

A crafted USB device can exploit this by first sending a packet header
claiming a large payload but providing only a few bytes (setting up a
large partial_rem), then sending a very short follow-up transfer. The
memcpy reads past the skb data into adjacent heap memory, and the
resulting over-long frame is delivered to the network stack via
usbnet_skb_return(), potentially leaking kernel heap contents.

Add a check that skb->len >= partial_rem before the reassembly memcpy.
When the transfer is too short, reset partial_rem and drop the frame.

Fixes: cc28a20e77b2 ("introduce cx82310_eth: Conexant CX82310-based ADSL router USB ethernet driver")
Signed-off-by: Aamir Ahmed <elb12345@xxxxxxxxxxxxx>
---
 drivers/net/usb/cx82310_eth.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c
index 068acb052adb0..e243898917fdb 100644
--- a/drivers/net/usb/cx82310_eth.c
+++ b/drivers/net/usb/cx82310_eth.c
@@ -251,6 +251,10 @@ static int cx82310_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 	 * end of that packet at the beginning.
 	 */
 	if (dev->partial_rem) {
+		if (skb->len < dev->partial_rem) {
+			dev->partial_rem = 0;
+			return 0;
+		}
 		len = dev->partial_len + dev->partial_rem;
 		skb2 = alloc_skb(len, GFP_ATOMIC);
 		if (!skb2)
-- 
2.43.0