control_msg_handler() handles a CTL_ID_HS2_MSG control message by pulling the ctrl_msg_header and passing the modem-supplied data_length as the length of the handshake-2 payload to t7xx_fsm_append_event(): ret = t7xx_fsm_append_event(ctl, event, skb->data, le32_to_cpu(ctrl_msg_h->data_length)); data_length is a device-controlled __le32 that is never bounded against the actual received payload (skb->len after the pull). t7xx_fsm_append_event() then does memcpy(event->data, data, length) with skb->data as the source, so a data_length larger than the payload reads out of bounds past the control skb (the destination is sized to length, so only the source over-reads). A compromised or malfunctioning modem can trigger it during the bring-up handshake; both the modem and AP control ports reach the same call site. Reject a data_length that exceeds the received payload. Found by 0sec (https://0sec.ai) using automated source analysis; the missing bound is evident from source. Compile-tested. Fixes: da45d2566a1d ("net: wwan: t7xx: Add control port") Cc: stable@vger.kernel.org Assisted-by: 0sec:claude-opus-4-8 Signed-off-by: Doruk Tan Ozturk --- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c b/drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c index f869e4ed9ee9..871ed63d3c4d 100644 --- a/drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c +++ b/drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c @@ -186,10 +186,15 @@ static int control_msg_handler(struct t7xx_port *port, struct sk_buff *skb) int event = port_conf->rx_ch == PORT_CH_CONTROL_RX ? FSM_EVENT_MD_HS2 : FSM_EVENT_AP_HS2; - ret = t7xx_fsm_append_event(ctl, event, skb->data, - le32_to_cpu(ctrl_msg_h->data_length)); - if (ret) - dev_err(port->dev, "Failed to append Handshake 2 event"); + if (le32_to_cpu(ctrl_msg_h->data_length) > skb->len) { + dev_err(port->dev, "Invalid Handshake 2 data length\n"); + ret = -EINVAL; + } else { + ret = t7xx_fsm_append_event(ctl, event, skb->data, + le32_to_cpu(ctrl_msg_h->data_length)); + if (ret) + dev_err(port->dev, "Failed to append Handshake 2 event"); + } } dev_kfree_skb_any(skb); -- 2.43.0