From nobody Sat Jul 25 23:42:05 2026 Received: from mail-wr1-f49.google.com (mail-wr1-f49.google.com [209.85.221.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6FF3C37881F for ; Sat, 11 Jul 2026 07:13:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783754025; cv=none; b=qhNT4NjQDwgSzp1F+DXgCCJVP8zDB1GHTC3qcwrUE+3VtsslN3APwVu7Fn0PwYjC+Sp4z0MiTGH3hAeZ8rrS6cBacaW4G8dvn1fGuBjUlIlOc6kOmrYtUUPyEKek5uA/+YcKp0okleN0K42F0dn1CKVS3ATGsQnpSnnBIzmIrHU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783754025; c=relaxed/simple; bh=+/tkY4Q2PIoNmSY1FcLszemDBSTTa8pciPDIAh6Unuc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=bd1hIXifvP4o4vcyVQ4VENonmDPQXS+p0798s9+Z2qwexg7+NdngAxegNesGVEaSqaMQteK6kt8jHkuy6+xJP8gfqDXLnlhqKrShB4kjd820TBbFBWh2XR5wyAMk5iPmWvNcW7qZen4yomYFTLL3VmXRTvSYZ6GF11YnvOE5vqA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=0sec.ai; spf=pass smtp.mailfrom=0sec.ai; dkim=temperror (0-bit key) header.d=0sec.ai header.i=@0sec.ai header.b=zZjQOj4+; arc=none smtp.client-ip=209.85.221.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=0sec.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=0sec.ai Authentication-Results: smtp.subspace.kernel.org; dkim=temperror (0-bit key) header.d=0sec.ai header.i=@0sec.ai header.b="zZjQOj4+" Received: by mail-wr1-f49.google.com with SMTP id ffacd0b85a97d-4629051c9d1so909181f8f.2 for ; Sat, 11 Jul 2026 00:13:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=0sec.ai; s=google; t=1783754022; x=1784358822; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=dEi1m+eaAK5Iu/90PGDOyH4Bqqrw8wWIiPdDe9qpKnE=; b=zZjQOj4+N+RwhF0Ipc/kaaFTRi7StYKtnHdJCdkr4ph+4ukZdRREQRCBZOtS+d78ha FLmcKcv/gtsxk6vt4Hl2J5DK7mxymy4XDHvcZ1bSv3tUZ9XQ7mhTtLRP7RwzEWsXINo4 176V/NzegZdQkRZTvYJLjEZDr9EBtFYMYtTg03xoc3KZWq4zAnNK/telHlXCRh9O6QWC pCRoEaB/UyRjqiOszlSz/6r2qYUq2BXp2442N6CxP+Ggbks1TjVntRAtsMkjr3JG33Ur ZqDIp7/H9P3jWyFGwYjXtNpEd0UzrVhd0QcAI8h5fU15y2uWADj48x0AI+fnA2oluDEQ WAbA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783754022; x=1784358822; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=dEi1m+eaAK5Iu/90PGDOyH4Bqqrw8wWIiPdDe9qpKnE=; b=oRXC/MTakABFMDPbJ8dsb2EPtvODdheMS4XQbtoGkWo6ySWYRKtj0+pLFTaggAEoxI mxR0iT4d5qTfp25a73GyeUrNXSm+QG823S0j5VYx5pSRAjg3q6y3fgElIF2hKSfZUpo+ bySWZ8Y72TDcKfi0OTcjhOdDL3vcyg2Txqx9LhKM4sys5gsjQjKrnPW8pbmh6PrjXucY Gxb7aaYrMcq1B/wonrpr+v+wEVWl+kdCxTQwlF8o0ghWYiiArDnYacXXl2Aa2iZfOTmK 2jckbIhQlBk6ykXeLWiw7ITBlGvo9emf/fbDOQcPpetG/TiCNAXp/xuFZqvMCXI5ltaA ++lQ== X-Forwarded-Encrypted: i=1; AHgh+RpzZyxYJYydIvp8MEBaO7XEa9ZaCP2iQHb1Y8g6PxTnVBVm6uhN4PlLDfTmIJNNmHbEGfY17hZt8HrlVFQ=@vger.kernel.org X-Gm-Message-State: AOJu0YxSNMhqaOBiwy8YrGo6OK+Fju6cHXqJjDnaz2I6lBPnfcPEi6bW 2qBIi6ZLeXfJFoxIjblKgISR+IjIIaz7qUXpQOfGlFnO7veoN7PHdL94lgLMytG7aomM X-Gm-Gg: AfdE7clFg1jz7a2xRoKxel+axhxcmEgOVufzePwXvOa2keU71aKt8uRcBseXD1cp2lg YvPCBz8iTP61iMwQZ+fHW5/o4uIDcGKZ0z8fPwSfIobZLvUrKQpLXzko/ggZNL4uIx07t5zVkpB NmPBi1bSdWwhQpHq9LC+NLbg7JOMPcBEON+MHkt764JyDMppw3Eg1cEK/7TMB5y1VGni2PFrj/H oIaNpxzHoy/+hxnw3w6TLwWt5T4me3e1y4UzM3nsIvo2OtEBJYG/FrD5LxaBQ0WfPiCMyJ1Hhy6 LIUy+0vGZ4/UxhCumlgLqtbNaoLj/Nkg4Z3WLtSOSL4Dvr7AVnB0g2HYFwZ0w0cGUl47U9nMONP buemNz9W14La1B3KS4gNZkpy7VmgxXgM0dZOIn0VjvVTOVR/5Z4bNmv/d6yurrUvErPDKeRkFPe dwLypZ93gfflXiKriUMrq8K/IcxzQPZfKHbyWUTnMwGg+b9fD3PeQCv6VC0WZiRkWTd8i9sxU0o M+h3SDBjjKq6icZ7MMY0Q11cNGSNFIRYpA= X-Received: by 2002:a05:600c:5395:b0:493:df5d:6ca6 with SMTP id 5b1f17b1804b1-493f881de70mr14942685e9.25.1783754021017; Sat, 11 Jul 2026 00:13:41 -0700 (PDT) Received: from PeakBook-Mini.tail8e484.ts.net ([178.197.218.188]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-493eb742a49sm185161215e9.12.2026.07.11.00.13.39 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sat, 11 Jul 2026 00:13:40 -0700 (PDT) From: Doruk Tan Ozturk To: Chandrashekar Devegowda , Ricardo Martinez Cc: Liu Haijun , Loic Poulain , Sergey Ryazanov , Johannes Berg , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH] net: wwan: t7xx: validate control-message data_length against the skb Date: Sat, 11 Jul 2026 09:13:38 +0200 Message-ID: <20260711071338.58345-1-doruk@0sec.ai> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" control_msg_handler() handles a CTL_ID_HS2_MSG control message by pulling the ctrl_msg_header and passing the modem-supplied data_length as the length of the handshake-2 payload to t7xx_fsm_append_event(): ret =3D t7xx_fsm_append_event(ctl, event, skb->data, le32_to_cpu(ctrl_msg_h->data_length)); data_length is a device-controlled __le32 that is never bounded against the actual received payload (skb->len after the pull). t7xx_fsm_append_event() then does memcpy(event->data, data, length) with skb->data as the source, so a data_length larger than the payload reads out of bounds past the control skb (the destination is sized to length, so only the source over-reads). A compromised or malfunctioning modem can trigger it during the bring-up handshake; both the modem and AP control ports reach the same call site. Reject a data_length that exceeds the received payload. Found by 0sec (https://0sec.ai) using automated source analysis; the missing bound is evident from source. Compile-tested. Fixes: da45d2566a1d ("net: wwan: t7xx: Add control port") Cc: stable@vger.kernel.org Assisted-by: 0sec:claude-opus-4-8 Signed-off-by: Doruk Tan Ozturk --- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c b/drivers/net/wwan/= t7xx/t7xx_port_ctrl_msg.c index f869e4ed9ee9..871ed63d3c4d 100644 --- a/drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c +++ b/drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c @@ -186,10 +186,15 @@ static int control_msg_handler(struct t7xx_port *port= , struct sk_buff *skb) int event =3D port_conf->rx_ch =3D=3D PORT_CH_CONTROL_RX ? FSM_EVENT_MD_HS2 : FSM_EVENT_AP_HS2; =20 - ret =3D t7xx_fsm_append_event(ctl, event, skb->data, - le32_to_cpu(ctrl_msg_h->data_length)); - if (ret) - dev_err(port->dev, "Failed to append Handshake 2 event"); + if (le32_to_cpu(ctrl_msg_h->data_length) > skb->len) { + dev_err(port->dev, "Invalid Handshake 2 data length\n"); + ret =3D -EINVAL; + } else { + ret =3D t7xx_fsm_append_event(ctl, event, skb->data, + le32_to_cpu(ctrl_msg_h->data_length)); + if (ret) + dev_err(port->dev, "Failed to append Handshake 2 event"); + } } =20 dev_kfree_skb_any(skb); --=20 2.43.0