kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/net/9p
History
Dominique Martinet df8462f0fc net/9p: Fix buffer overflow in USB transport layer 
commit c04db81cd0 upstream.

A buffer overflow vulnerability exists in the USB 9pfs transport layer
where inconsistent size validation between packet header parsing and
actual data copying allows a malicious USB host to overflow heap buffers.

The issue occurs because:
- usb9pfs_rx_header() validates only the declared size in packet header
- usb9pfs_rx_complete() uses req->actual (actual received bytes) for
memcpy

This allows an attacker to craft packets with small declared size
(bypassing validation) but large actual payload (triggering overflow
in memcpy).

Add validation in usb9pfs_rx_complete() to ensure req->actual does not
exceed the buffer capacity before copying data.

Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Closes: https://lkml.kernel.org/r/20250616132539.63434-1-danisjiang@gmail.com
Fixes: a3be076dc1 ("net/9p/usbg: Add new usb gadget function transport")
Cc: stable@vger.kernel.org
Message-ID: <20250622-9p-usb_overflow-v3-1-ab172691b946@codewreck.org>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-10-15 12:04:22 +02:00
..
client.c netfs: Fix the request's work item to not require a ref 2025-05-21 14:35:20 +02:00
error.c 9p: Use hashtable.h for hash_errmap 2025-03-23 06:20:48 +09:00
Kconfig net/9p/usbg: allow building as standalone module 2024-11-22 23:48:14 +09:00
Makefile net/9p/usbg: Add new usb gadget function transport 2024-09-03 09:57:08 +02:00
mod.c net/p9: load default transports 2022-01-10 10:00:09 +09:00
protocol.c net: 9p: avoid freeing uninit memory in p9pdu_vreadf 2023-12-13 05:44:30 +09:00
protocol.h net/9p: add p9_msg_buf_size() 2022-10-05 07:05:41 +09:00
trans_common.c 9p: fix file headers 2021-11-03 17:45:04 +09:00
trans_common.h 9p: fix a bunch of checkpatch warnings 2021-11-04 21:04:25 +09:00
trans_fd.c net/9p: fix double req put in p9_fd_cancelled 2025-10-12 13:01:57 +02:00
trans_rdma.c 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv() 2023-02-24 13:42:28 +00:00
trans_usbg.c net/9p: Fix buffer overflow in USB transport layer 2025-10-15 12:04:22 +02:00
trans_virtio.c net: 9p: virtio: drop owner assignment 2024-05-22 08:31:17 -04:00
trans_xen.c 9p/xen: fix release of IRQ 2024-11-22 23:36:19 +09:00