The NDP length is validated for its minimum size and alignment, but
not against the containing NTB. A host can provide an NDP near the
end of the block with an oversized length, causing the datagram parser
to read beyond the block.
The NDP index has already been checked against block_len, so compare
the length with the remaining bytes using an overflow-safe
subtraction.
Fixes: 9f6ce4240a2b ("usb: gadget: f_ncm.c added")
Reported-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://lore.kernel.org/r/20260708123048.760209-1-lgs201920130244@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
drivers/usb/gadget/function/f_ncm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
index 64eabda2f..1ff05eb0f 100644
--- a/drivers/usb/gadget/function/f_ncm.c
+++ b/drivers/usb/gadget/function/f_ncm.c
@@ -1262,7 +1262,8 @@ static int ncm_unwrap_ntb(struct gether *port,
*/
if ((ndp_len < opts->ndp_size
+ 2 * 2 * (opts->dgram_item_len * 2)) ||
- (ndp_len % opts->ndplen_align != 0)) {
+ (ndp_len % opts->ndplen_align != 0) ||
+ (ndp_len > block_len - ndp_index)) {
INFO(port->func.config->cdev, "Bad NDP length: %#X\n",
ndp_len);
goto err;
--
2.43.0