Unverified Commit 83f86d69 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!15298 usbnet: ipheth: fix possible overflow in DPE length check 

Merge Pull Request from: @ci-robot 
 
PR sync from: Pu Lehui <pulehui@huawei.com>
https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/EXGEAZ2C53BLU4Z6ZQFVHTYI2US6HIS2/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBPC69 
 
Link:https://gitee.com/openeuler/kernel/pulls/15298

 

Reviewed-by: default avatarZhang Peng <zhangpeng362@huawei.com>
Reviewed-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents b29a76eb d6f351c4

drivers/net/usb/ipheth.c

+2 −2
Original line number Diff line number Diff line
@@ -243,8 +243,8 @@ static int ipheth_rcvbulk_callback_ncm(struct urb *urb) 
	while (le16_to_cpu(dpe->wDatagramIndex) != 0 &&

	       le16_to_cpu(dpe->wDatagramLength) != 0) {

		if (le16_to_cpu(dpe->wDatagramIndex) >= urb->actual_length ||

		    le16_to_cpu(dpe->wDatagramIndex) +

		    le16_to_cpu(dpe->wDatagramLength) > urb->actual_length) {

		    le16_to_cpu(dpe->wDatagramLength) > urb->actual_length -

		    le16_to_cpu(dpe->wDatagramIndex)) {

			dev->net->stats.rx_length_errors++;

			return retval;

		}