Re: [PATCH] net: wwan: t7xx: validate the HS2 message data length

[Loic Poulain]

On Wed, Sep 9, 2026 at 7:44 AM Guanglei Zhu <zhugl3@xxxxxxxxxxxx> wrote:
>
> control_msg_handler() passes the modem-supplied data_length field of a
> CTL_ID_HS2_MSG message straight to t7xx_fsm_append_event(), which
> memcpy()s that many bytes out of the skb.  Nothing compares the field
> with the actual length of the message, so a modem reporting a larger
> data_length makes the driver read past the end of the skb and store
> kernel heap memory in the FSM event.
>
> 0e7c074cfcd9 ("net: wwan: t7xx: validate port_count against message
> length in t7xx_port_enum_msg_handler") added this kind of check for
> the port enumeration path but missed the handshake path.
>
> Reject the message when data_length does not fit into the skb.
>
> Fixes: da45d2566a1d ("net: wwan: t7xx: Add control port")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Guanglei Zhu <zhugl3@xxxxxxxxxxxx>

Reviewed-by: Loic Poulain <loic.poulain@xxxxxxxxxxxxxxxx>

> ---
>
> Verified in a QEMU guest with a fault injector feeding the driver's
> control port thread a handshake message whose data_length exceeds the
> skb: the unpatched driver trips KASAN on a read of 8192 bytes past a
> 500-byte payload, and the extra bytes land in the FSM event.  With
> this check the message is rejected, and well-formed handshakes are
> unaffected.
>  drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 20 +++++++++++++++-----
>  1 file changed, 15 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c b/drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c
> index f869e4ed9..0f2ead8a7 100644
> --- a/drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c
> +++ b/drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c
> @@ -178,22 +178,32 @@ static int control_msg_handler(struct t7xx_port *port, struct sk_buff *skb)
>
>         ctrl_msg_h = (struct ctrl_msg_header *)skb->data;
>         switch (le32_to_cpu(ctrl_msg_h->ctrl_msg_id)) {
> -       case CTL_ID_HS2_MSG:
> +       case CTL_ID_HS2_MSG: {
> +               u32 data_length;
> +
>                 skb_pull(skb, sizeof(*ctrl_msg_h));
> +               data_length = le32_to_cpu(ctrl_msg_h->data_length);
>
>                 if (port_conf->rx_ch == PORT_CH_CONTROL_RX ||
>                     port_conf->rx_ch == PORT_CH_AP_CONTROL_RX) {
>                         int event = port_conf->rx_ch == PORT_CH_CONTROL_RX ?
>                                     FSM_EVENT_MD_HS2 : FSM_EVENT_AP_HS2;
>
> -                       ret = t7xx_fsm_append_event(ctl, event, skb->data,
> -                                                   le32_to_cpu(ctrl_msg_h->data_length));
> -                       if (ret)
> -                               dev_err(port->dev, "Failed to append Handshake 2 event");
> +                       if (data_length > skb->len) {
> +                               dev_err(port->dev, "Invalid HS2 message length %u\n",
> +                                       data_length);
> +                               ret = -EINVAL;
> +                       } else {
> +                               ret = t7xx_fsm_append_event(ctl, event, skb->data,
> +                                                           data_length);
> +                               if (ret)
> +                                       dev_err(port->dev, "Failed to append Handshake 2 event");
> +                       }
>                 }
>
>                 dev_kfree_skb_any(skb);
>                 break;
> +       }
>
>         case CTL_ID_MD_EX:
>         case CTL_ID_MD_EX_ACK:
> --
> 2.43.0
>