linux-stable/drivers/net/usb
Szymon Heidrich 7f247f5a2c net: usb: lan78xx: Limit packet length to skb->len
Packet length retrieved from descriptor may be larger than
the actual socket buffer length. In such case the cloned
skb passed up the network stack will leak kernel memory contents.

Additionally prevent integer underflow when size is less than
ETH_FCS_LEN.

Fixes: 55d7de9de6 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-03-20 10:15:15 +00:00
..
aqc111.c net: move from strlcpy with unused retval to strscpy 2022-08-31 14:11:07 -07:00
aqc111.h
asix.h net: asix: ax88772: migrate to phylink 2022-08-26 10:00:52 +01:00
asix_common.c net: move from strlcpy with unused retval to strscpy 2022-08-31 14:11:07 -07:00
asix_devices.c net: asix: add support for the Linux Automation GmbH USB 10Base-T1L 2022-12-07 17:12:09 -08:00
ax88172a.c
ax88179_178a.c Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP" 2022-08-10 09:28:56 +01:00
catc.c net: move from strlcpy with unused retval to strscpy 2022-08-31 14:11:07 -07:00
cdc-phonet.c
cdc_eem.c cdc-eem: always use BIT 2022-07-01 13:39:03 +01:00
cdc_ether.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2023-01-12 19:59:56 -08:00
cdc_mbim.c net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990 2023-03-07 15:27:01 +01:00
cdc_ncm.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-11-29 13:04:52 -08:00
cdc_subset.c net: usb: delete extra space and tab in blank line 2022-07-28 21:48:20 -07:00
ch9200.c
cx82310_eth.c
dm9601.c
gl620a.c usbnet: gl620a: Replace one-element array with flexible-array member 2022-02-22 17:00:54 -08:00
hso.c tty: Make ->set_termios() old ktermios const 2022-08-30 14:22:35 +02:00
huawei_cdc_ncm.c
int51x1.c
ipheth.c ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback 2022-02-01 20:25:38 -08:00
kalmia.c net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path 2023-02-13 09:41:14 +00:00
kaweth.c net: usb: delete extra space and tab in blank line 2022-07-28 21:48:20 -07:00
Kconfig net: asix: ax88772: migrate to phylink 2022-08-26 10:00:52 +01:00
lan78xx.c net: usb: lan78xx: Limit packet length to skb->len 2023-03-20 10:15:15 +00:00
lan78xx.h
lg-vl600.c
Makefile
mcs7830.c net: mcs7830: handle usb read errors properly 2022-01-09 16:35:50 -08:00
net1080.c
pegasus.c net: move from strlcpy with unused retval to strscpy 2022-08-31 14:11:07 -07:00
pegasus.h
plusb.c net: USB: Fix wrong-direction WARNING in plusb.c 2023-02-06 09:59:35 +00:00
qmi_wwan.c net: usb: qmi_wwan: add Telit 0x1080 composition 2023-03-07 15:27:29 +01:00
r8152.c r8152: reduce the control transfer of rtl8152_get_version() 2023-01-20 18:06:09 -08:00
r8153_ecm.c
rndis_host.c usb: rndis_host: Secure rndis_query check against int overflow 2023-01-03 09:24:41 +00:00
rtl8150.c net: move from strlcpy with unused retval to strscpy 2022-08-31 14:11:07 -07:00
sierra_net.c treewide: Convert del_timer*() to timer_shutdown*() 2022-12-25 13:38:09 -08:00
smsc75xx.c net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull 2023-03-16 17:27:56 -07:00
smsc75xx.h
smsc95xx.c net: usb: smsc95xx: Limit packet length to skb->len 2023-03-17 21:58:26 -07:00
smsc95xx.h
sr9700.c net: usb: sr9700: Handle negative len 2023-01-17 11:50:42 +01:00
sr9700.h
sr9800.c
sr9800.h USB2NET : SR9800 : change SR9800_BULKIN_SIZE from global to static 2022-04-22 12:43:35 +01:00
usbnet.c usbnet: optimize usbnet_bh() to reduce CPU load 2023-01-09 07:23:54 +00:00
zaurus.c USB: zaurus: support another broken Zaurus 2022-02-14 14:37:15 +00:00