[PATCH net,stable] net: cdc_ncm: fix buffer overflow

[PATCH net,stable] net: cdc_ncm: fix buffer overflow

[Bjørn Mork]

Commit 4d619f625a60 ("net: cdc_ncm: no point in filling up the NTBs
if we send ZLPs") changed the padding logic for devices with the ZLP
flag set.  This meant that frames of any size will be sent without
additional padding, except for the single byte added if the size is
a multiple of the USB packet size. But if the unpadded size is
identical to the maximum frame size, and the maximum size is a
multiplum of the USB packet size, then this one-byte padding will
overflow the buffer.

Prevent padding if already at maximum frame size, letting usbnet
transmit a ZLP instead in this case.

Fixes: 4d619f625a60 ("net: cdc_ncm: no point in filling up the NTBs if we send ZLPs")
Reported by: Yu-an Shih <yshih@nvidia.com>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
---
Please add this to the stable v3.13 and v3.14 queues as well.  Thanks.

 drivers/net/usb/cdc_ncm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 549dbac710ed..9a2bd11943eb 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -785,7 +785,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
 	    skb_out->len > CDC_NCM_MIN_TX_PKT)
 		memset(skb_put(skb_out, ctx->tx_max - skb_out->len), 0,
 		       ctx->tx_max - skb_out->len);
-	else if ((skb_out->len % dev->maxpacket) == 0)
+	else if (skb_out->len < ctx->tx_max && (skb_out->len % dev->maxpacket) == 0)
 		*skb_put(skb_out, 1) = 0;	/* force short packet */
 
 	/* set final frame length */
-- 
2.0.0.rc0

Re: [PATCH net,stable] net: cdc_ncm: fix buffer overflow

[David Miller]

From: Bjørn Mork <bjorn@mork.no>
Date: Fri,  2 May 2014 23:27:00 +0200

> Commit 4d619f625a60 ("net: cdc_ncm: no point in filling up the NTBs
> if we send ZLPs") changed the padding logic for devices with the ZLP
> flag set.  This meant that frames of any size will be sent without
> additional padding, except for the single byte added if the size is
> a multiple of the USB packet size. But if the unpadded size is
> identical to the maximum frame size, and the maximum size is a
> multiplum of the USB packet size, then this one-byte padding will
> overflow the buffer.
> 
> Prevent padding if already at maximum frame size, letting usbnet
> transmit a ZLP instead in this case.
> 
> Fixes: 4d619f625a60 ("net: cdc_ncm: no point in filling up the NTBs if we send ZLPs")
> Reported by: Yu-an Shih <yshih@nvidia.com>
> Signed-off-by: Bjørn Mork <bjorn@mork.no>
> ---
> Please add this to the stable v3.13 and v3.14 queues as well.  Thanks.

Applied and queued up for -stable, thanks.