[net,stable] net: cdc_ether: fix divide by 0 on bad descriptors

Message ID 20171106143722.3171-1-bjorn@mork.no
State Accepted
Delegated to: David Miller
Headers show
Series
  • [net,stable] net: cdc_ether: fix divide by 0 on bad descriptors
Related show

Commit Message

Bjørn Mork Nov. 6, 2017, 2:37 p.m.
Setting dev->hard_mtu to 0 will cause a divide error in
usbnet_probe. Protect against devices with bogus CDC Ethernet
functional descriptors by ignoring a zero wMaxSegmentSize.

Signed-off-by: Bjørn Mork <bjorn@mork.no>
---
I believe the problem found by syzcaller in qmi_wwan also applies
to cdc_ether.  We cannot allow the .bind callback to set
dev->hard_mtu to 0.

 drivers/net/usb/cdc_ether.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Oliver Neukum Nov. 6, 2017, 2:35 p.m. | #1
Am Montag, den 06.11.2017, 15:37 +0100 schrieb Bjørn Mork :
> Setting dev->hard_mtu to 0 will cause a divide error in
> usbnet_probe. Protect against devices with bogus CDC Ethernet
> functional descriptors by ignoring a zero wMaxSegmentSize.
> 
> Signed-off-by: Bjørn Mork <bjorn@mork.no>
Acked-by: Oliver Neukum <oneukum@suse.com>
David Miller Nov. 8, 2017, 4:44 a.m. | #2
From: Bjørn Mork <bjorn@mork.no>
Date: Mon,  6 Nov 2017 15:37:22 +0100

> Setting dev->hard_mtu to 0 will cause a divide error in
> usbnet_probe. Protect against devices with bogus CDC Ethernet
> functional descriptors by ignoring a zero wMaxSegmentSize.
> 
> Signed-off-by: Bjørn Mork <bjorn@mork.no>

Applied and queued up for -stable.

Patch

diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 3e7a3ac3a362..05dca3e5c93d 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -230,7 +230,7 @@  int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
 			goto bad_desc;
 	}
 
-	if (header.usb_cdc_ether_desc) {
+	if (header.usb_cdc_ether_desc && info->ether->wMaxSegmentSize) {
 		dev->hard_mtu = le16_to_cpu(info->ether->wMaxSegmentSize);
 		/* because of Zaurus, we may be ignoring the host
 		 * side link address we were given.