ncsi_rsp_handler_gp() iterates over the MAC address and VLAN filter tables using the counts from the Get Parameters response itself, rsp->mac_cnt and rsp->vlan_cnt. The arrays it writes into, however, were allocated by the Get Controller Capabilities handler from the independent rsp->uc_cnt, rsp->mc_cnt, rsp->mixed_cnt and rsp->vlan_cnt fields. A malicious or buggy NCSI device can therefore report contradictory counts in the two responses - for example a GC response advertising a single unicast address filter followed by a GP response with mac_cnt = 255. The GP handler then memcpy()s 255 MAC addresses into the 6-byte kzalloc()ed buffer, a heap out-of-bounds write of roughly 1.5KB of device-controlled data, and the same applies to vlan_cnt versus the vids[] array. The loop indices are additionally used as bit numbers for set_bit()/clear_bit() on the u64 filter bitmaps, so any count larger than 64 writes out-of-bounds bits into struct ncsi_channel. Clamp both loops to the number of entries actually allocated for the channel and to the capacity of the bitmap word, mirroring the validation the SVF and SMA handlers already apply to their indices. Fixes: 138635cc27c9 ("net/ncsi: NCSI response packet handler") Cc: stable@vger.kernel.org Signed-off-by: Vamsi Krishna Kattamuri --- net/ncsi/ncsi-rsp.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c index fbd84bc8026a..fa1ed405dfbb 100644 --- a/net/ncsi/ncsi-rsp.c +++ b/net/ncsi/ncsi-rsp.c @@ -883,7 +883,9 @@ static int ncsi_rsp_handler_gp(struct ncsi_request *nr) ncmf = &nc->mac_filter; spin_lock_irqsave(&nc->lock, flags); bitmap = &ncmf->bitmap; - for (i = 0; i < rsp->mac_cnt; i++, pdata += 6) { + for (i = 0; i < rsp->mac_cnt && + i < ncmf->n_uc + ncmf->n_mc + ncmf->n_mixed && + i < sizeof(ncmf->bitmap) * 8; i++, pdata += 6) { if (!(enable & (0x1 << i))) clear_bit(i, bitmap); else @@ -898,7 +900,8 @@ static int ncsi_rsp_handler_gp(struct ncsi_request *nr) ncvf = &nc->vlan_filter; bitmap = &ncvf->bitmap; spin_lock_irqsave(&nc->lock, flags); - for (i = 0; i < rsp->vlan_cnt; i++, pdata += 2) { + for (i = 0; i < rsp->vlan_cnt && i < ncvf->n_vids && + i < sizeof(ncvf->bitmap) * 8; i++, pdata += 2) { if (!(enable & (0x1 << i))) clear_bit(i, bitmap); else -- 2.47.3