mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-20 09:31:09 +00:00
staging: gdm724x: check for overflow in gdm_lte_netif_rx()
[ Upstream commit7002b526f4
] This code assumes that "len" is at least 62 bytes, but we need a check to prevent a read overflow. Fixes:61e1210476
("staging: gdm7240: adding LTE USB driver") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/r/YMcoTPsCYlhh2TQo@mwanda Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
f937370610
commit
7bc3fa5db4
1 changed files with 6 additions and 4 deletions
|
@ -611,10 +611,12 @@ static void gdm_lte_netif_rx(struct net_device *dev, char *buf,
|
|||
* bytes (99,130,83,99 dec)
|
||||
*/
|
||||
} __packed;
|
||||
void *addr = buf + sizeof(struct iphdr) +
|
||||
sizeof(struct udphdr) +
|
||||
offsetof(struct dhcp_packet, chaddr);
|
||||
ether_addr_copy(nic->dest_mac_addr, addr);
|
||||
int offset = sizeof(struct iphdr) +
|
||||
sizeof(struct udphdr) +
|
||||
offsetof(struct dhcp_packet, chaddr);
|
||||
if (offset + ETH_ALEN > len)
|
||||
return;
|
||||
ether_addr_copy(nic->dest_mac_addr, buf + offset);
|
||||
}
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue