kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/net/9p
History
Dominique Martinet 0da18d49f8 net/9p: Fix buffer overflow in USB transport layer 
commit c04db81cd0 upstream.

A buffer overflow vulnerability exists in the USB 9pfs transport layer
where inconsistent size validation between packet header parsing and
actual data copying allows a malicious USB host to overflow heap buffers.

The issue occurs because:
- usb9pfs_rx_header() validates only the declared size in packet header
- usb9pfs_rx_complete() uses req->actual (actual received bytes) for
memcpy

This allows an attacker to craft packets with small declared size
(bypassing validation) but large actual payload (triggering overflow
in memcpy).

Add validation in usb9pfs_rx_complete() to ensure req->actual does not
exceed the buffer capacity before copying data.

Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Closes: https://lkml.kernel.org/r/20250616132539.63434-1-danisjiang@gmail.com
Fixes: a3be076dc1 ("net/9p/usbg: Add new usb gadget function transport")
Cc: stable@vger.kernel.org
Message-ID: <20250622-9p-usb_overflow-v3-1-ab172691b946@codewreck.org>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-10-15 12:00:24 +02:00
..
client.c 9p/net: fix improper handling of bogus negative read/write replies 2025-05-02 07:59:20 +02:00
error.c 9p: fix a bunch of checkpatch warnings 2021-11-04 21:04:25 +09:00
Kconfig net/9p/usbg: Fix build error 2024-10-09 09:56:40 +02:00
Makefile net/9p/usbg: Add new usb gadget function transport 2024-09-03 09:57:08 +02:00
mod.c net/p9: load default transports 2022-01-10 10:00:09 +09:00
protocol.c net: 9p: avoid freeing uninit memory in p9pdu_vreadf 2023-12-13 05:44:30 +09:00
protocol.h net/9p: add p9_msg_buf_size() 2022-10-05 07:05:41 +09:00
trans_common.c 9p: fix file headers 2021-11-03 17:45:04 +09:00
trans_common.h 9p: fix a bunch of checkpatch warnings 2021-11-04 21:04:25 +09:00
trans_fd.c net/9p: fix double req put in p9_fd_cancelled 2025-10-12 12:57:19 +02:00
trans_rdma.c 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv() 2023-02-24 13:42:28 +00:00
trans_usbg.c net/9p: Fix buffer overflow in USB transport layer 2025-10-15 12:00:24 +02:00
trans_virtio.c net: 9p: virtio: drop owner assignment 2024-05-22 08:31:17 -04:00
trans_xen.c 9p/xen: fix release of IRQ 2024-12-05 14:03:06 +01:00