diff options
| author | Jakub Kicinski | 2022-04-07 23:24:23 -0700 |
|---|---|---|
| committer | Jakub Kicinski | 2022-04-07 23:24:23 -0700 |
| commit | dc2e0617f1fd0c5a6f601502b4379113a84ffecf (patch) | |
| tree | d6959aa21296841b6ec543291cd66ed66a6e5c33 /drivers/net/usb | |
| parent | 27a5a5685d373cd8c18b1d83f42a83e5a2f93e6c (diff) | |
| parent | 73b193f265096080eac866b9a852627b475384fc (diff) | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
No conflicts.
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers/net/usb')
| -rw-r--r-- | drivers/net/usb/aqc111.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c index ea06d10e1c21..ca409d450a29 100644 --- a/drivers/net/usb/aqc111.c +++ b/drivers/net/usb/aqc111.c @@ -1102,10 +1102,15 @@ static int aqc111_rx_fixup(struct usbnet *dev, struct sk_buff *skb) if (start_of_descs != desc_offset) goto err; - /* self check desc_offset from header*/ - if (desc_offset >= skb_len) + /* self check desc_offset from header and make sure that the + * bounds of the metadata array are inside the SKB + */ + if (pkt_count * 2 + desc_offset >= skb_len) goto err; + /* Packets must not overlap the metadata array */ + skb_trim(skb, desc_offset); + if (pkt_count == 0) goto err; |