net: usb: smsc95xx: Limit packet length to skb->len
authorSzymon Heidrich <szymon.heidrich@gmail.com>
Thu, 16 Mar 2023 10:19:54 +0000 (11:19 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 30 Mar 2023 10:47:45 +0000 (12:47 +0200)
commitba6c40227108f8ee428e42eb0337b48ed3001e65
tree47bd284a01c2202750879e6693c645a58869bf38
parent9bbb3d3f218f1cf51f57a43cf8fd63b05be1b821
net: usb: smsc95xx: Limit packet length to skb->len

[ Upstream commit ff821092cf02a70c2bccd2d19269f01e29aa52cf ]

Packet length retrieved from descriptor may be larger than
the actual socket buffer length. In such case the cloned
skb passed up the network stack will leak kernel memory contents.

Fixes: 2f7ca802bdae ("net: Add SMSC LAN9500 USB2.0 10/100 ethernet adapter driver")
Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Link: https://lore.kernel.org/r/20230316101954.75836-1-szymon.heidrich@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/usb/smsc95xx.c