Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <6813a7ce-93f1-3a63-0641-f6a77aa7c343@gmail.com>
Date:   Thu, 23 Mar 2023 21:57:51 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0)
 Gecko/20100101 Thunderbird/102.9.0
Subject: Re: [PATCH v2] net: usb: lan78xx: Limit packet length to skb->len
To:     Greg KH <gregkh@linuxfoundation.org>
Cc:     woojung.huh@microchip.com, UNGLinuxDriver@microchip.com,
        kuba@kernel.org, davem@davemloft.net, edumazet@google.com,
        pabeni@redhat.com, linux-usb@vger.kernel.org,
        netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
        kernel test robot <lkp@intel.com>
References: <202303180031.EsiDo4qY-lkp@intel.com>
 <20230317173606.91426-1-szymon.heidrich@gmail.com>
 <ZBx+eGTSjRM8fvsf@kroah.com>
Content-Language: en-US
From:   Szymon Heidrich <szymon.heidrich@gmail.com>
In-Reply-To: <ZBx+eGTSjRM8fvsf@kroah.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 23/03/2023 17:29, Greg KH wrote:
> On Fri, Mar 17, 2023 at 06:36:06PM +0100, Szymon Heidrich wrote:
>> Packet length retrieved from descriptor may be larger than
>> the actual socket buffer length. In such case the cloned
>> skb passed up the network stack will leak kernel memory contents.
>>
>> Additionally prevent integer underflow when size is less than
>> ETH_FCS_LEN.
>>
>> Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
>> Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com>
>> Reported-by: kernel test robot <lkp@intel.com>
> 
> the test robot did not report the fact that the packet length needed to
> be limited :(
> 

Yes, I removed the Reported-by tag in V3 as suggested by Jakub.