From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3F7D9C10F14 for ; Thu, 3 Oct 2019 17:27:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0BA3520865 for ; Thu, 3 Oct 2019 17:27:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1570123637; bh=zBya74pRYDPzIK4cQdHPpJIitnD/nPJtdMLpRb7hGTU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=kuHe+EkZhuwIacs74jnOCGsvzZvcVPYDiGSsqghelv1l6Cu7TIrBZFXYzO8Ivq17b yfhmyeZcNvNFO0d1PR6XFlV/kMoOkrTFTTityTUNKlTAF7p3V2J+gcMtZ8uBefxhFk Uoew7CmK0lSBKJXx2pZXq8S1R8FnuwWJ0M39rWCg= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387410AbfJCQPB (ORCPT ); Thu, 3 Oct 2019 12:15:01 -0400 Received: from mail.kernel.org ([198.145.29.99]:38726 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388752AbfJCQO6 (ORCPT ); Thu, 3 Oct 2019 12:14:58 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B552121783; Thu, 3 Oct 2019 16:14:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1570119298; bh=zBya74pRYDPzIK4cQdHPpJIitnD/nPJtdMLpRb7hGTU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CvYUTsj/rLvLFLtkedzuTV6a5OYsm10830DSqPg5X8kgfjwPhtMKCOmRzXr9izIkA DMlb+IHE5Y/zQnM6ILJCU/lIWFN2wDl6nrmTxAXnUNRYhktgdQmDECyeK8bnhZTuxO 2MMbXkc5opVqYRzuQwpcf3GE8kOrNcjTGC2Ah2aw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oliver Neukum , "David S. Miller" Subject: [PATCH 4.19 014/211] usbnet: sanity checking of packet sizes and device mtu Date: Thu, 3 Oct 2019 17:51:20 +0200 Message-Id: <20191003154450.103690210@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20191003154447.010950442@linuxfoundation.org> References: <20191003154447.010950442@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Oliver Neukum [ Upstream commit 280ceaed79f18db930c0cc8bb21f6493490bf29c ] After a reset packet sizes and device mtu can change and need to be reevaluated to calculate queue sizes. Malicious devices can set this to zero and we divide by it. Introduce sanity checking. Reported-and-tested-by: syzbot+6102c120be558c885f04@syzkaller.appspotmail.com Signed-off-by: Oliver Neukum Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/usb/usbnet.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/net/usb/usbnet.c +++ b/drivers/net/usb/usbnet.c @@ -356,6 +356,8 @@ void usbnet_update_max_qlen(struct usbne { enum usb_device_speed speed = dev->udev->speed; + if (!dev->rx_urb_size || !dev->hard_mtu) + goto insanity; switch (speed) { case USB_SPEED_HIGH: dev->rx_qlen = MAX_QUEUE_MEMORY / dev->rx_urb_size; @@ -372,6 +374,7 @@ void usbnet_update_max_qlen(struct usbne dev->tx_qlen = 5 * MAX_QUEUE_MEMORY / dev->hard_mtu; break; default: +insanity: dev->rx_qlen = dev->tx_qlen = 4; } }