Unverified Commit 5d32aa69 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!7776 [sync] PR-7717: CVE-2023-52655 

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/7717 
 
PR sync from: Yongqiang Liu <liuyongqiang13@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/VU4WQJK3PQ2NEUQQHKL66LNLOYUNYD37/ 
Oliver Neukum (1):
  usb: aqc111: check packet for fixup for true limit


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/I9OZ9P 
 
Link:https://gitee.com/openeuler/kernel/pulls/7776

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 82c827a3 d5c925b4

drivers/net/usb/aqc111.c

+4 −4
Original line number Diff line number Diff line
@@ -1079,17 +1079,17 @@ static int aqc111_rx_fixup(struct usbnet *dev, struct sk_buff *skb) 
	u16 pkt_count = 0;

	u64 desc_hdr = 0;

	u16 vlan_tag = 0;

	u32 skb_len = 0;

	u32 skb_len;



	if (!skb)

		goto err;



	if (skb->len == 0)

	skb_len = skb->len;

	if (skb_len < sizeof(desc_hdr))

		goto err;



	skb_len = skb->len;

	/* RX Descriptor Header */

	skb_trim(skb, skb->len - sizeof(desc_hdr));

	skb_trim(skb, skb_len - sizeof(desc_hdr));

	desc_hdr = le64_to_cpup((u64 *)skb_tail_pointer(skb));



	/* Check these packets */