| Message ID | 20171106143722.3171-1-bjorn@mork.no |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net,stable] net: cdc_ether: fix divide by 0 on bad descriptors | expand |
Am Montag, den 06.11.2017, 15:37 +0100 schrieb Bjørn Mork : > Setting dev->hard_mtu to 0 will cause a divide error in > usbnet_probe. Protect against devices with bogus CDC Ethernet > functional descriptors by ignoring a zero wMaxSegmentSize. > > Signed-off-by: Bjørn Mork <bjorn@mork.no> Acked-by: Oliver Neukum <oneukum@suse.com>
From: Bjørn Mork <bjorn@mork.no> Date: Mon, 6 Nov 2017 15:37:22 +0100 > Setting dev->hard_mtu to 0 will cause a divide error in > usbnet_probe. Protect against devices with bogus CDC Ethernet > functional descriptors by ignoring a zero wMaxSegmentSize. > > Signed-off-by: Bjørn Mork <bjorn@mork.no> Applied and queued up for -stable.
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c index 3e7a3ac3a362..05dca3e5c93d 100644 --- a/drivers/net/usb/cdc_ether.c +++ b/drivers/net/usb/cdc_ether.c @@ -230,7 +230,7 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf) goto bad_desc; } - if (header.usb_cdc_ether_desc) { + if (header.usb_cdc_ether_desc && info->ether->wMaxSegmentSize) { dev->hard_mtu = le16_to_cpu(info->ether->wMaxSegmentSize); /* because of Zaurus, we may be ignoring the host * side link address we were given.
Setting dev->hard_mtu to 0 will cause a divide error in usbnet_probe. Protect against devices with bogus CDC Ethernet functional descriptors by ignoring a zero wMaxSegmentSize. Signed-off-by: Bjørn Mork <bjorn@mork.no> --- I believe the problem found by syzcaller in qmi_wwan also applies to cdc_ether. We cannot allow the .bind callback to set dev->hard_mtu to 0. drivers/net/usb/cdc_ether.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)