* [PATCH] usbnet: sanity checking of packet sizes and device mtu
@ 2019-09-19 8:23 Oliver Neukum
2019-09-19 11:27 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Oliver Neukum @ 2019-09-19 8:23 UTC (permalink / raw)
To: davem, netdev; +Cc: Oliver Neukum
After a reset packet sizes and device mtu can change and need
to be reevaluated to calculate queue sizes.
Malicious devices can set this to zero and we divide by it.
Introduce sanity checking.
Reported-and-tested-by: syzbot+6102c120be558c885f04@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
---
drivers/net/usb/usbnet.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 58952a79b05f..e44849499b89 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -339,6 +339,8 @@ void usbnet_update_max_qlen(struct usbnet *dev)
{
enum usb_device_speed speed = dev->udev->speed;
+ if (!dev->rx_urb_size || !dev->hard_mtu)
+ goto insanity;
switch (speed) {
case USB_SPEED_HIGH:
dev->rx_qlen = MAX_QUEUE_MEMORY / dev->rx_urb_size;
@@ -355,6 +357,7 @@ void usbnet_update_max_qlen(struct usbnet *dev)
dev->tx_qlen = 5 * MAX_QUEUE_MEMORY / dev->hard_mtu;
break;
default:
+insanity:
dev->rx_qlen = dev->tx_qlen = 4;
}
}
--
2.16.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] usbnet: sanity checking of packet sizes and device mtu
2019-09-19 8:23 [PATCH] usbnet: sanity checking of packet sizes and device mtu Oliver Neukum
@ 2019-09-19 11:27 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2019-09-19 11:27 UTC (permalink / raw)
To: oneukum; +Cc: netdev
From: Oliver Neukum <oneukum@suse.com>
Date: Thu, 19 Sep 2019 10:23:08 +0200
> After a reset packet sizes and device mtu can change and need
> to be reevaluated to calculate queue sizes.
> Malicious devices can set this to zero and we divide by it.
> Introduce sanity checking.
>
> Reported-and-tested-by: syzbot+6102c120be558c885f04@syzkaller.appspotmail.com
> Signed-off-by: Oliver Neukum <oneukum@suse.com>
Applied and queued up for -stable.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-09-19 11:27 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-19 8:23 [PATCH] usbnet: sanity checking of packet sizes and device mtu Oliver Neukum
2019-09-19 11:27 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).