net1080_rx_fixup() only bounds the device-supplied packet_len against NC_MAX_PACKET. When packet_len is even it reads skb->data[packet_len] to check the pad byte, before the skb->len != packet_len check further down. A malicious NetChip 1080 device can send a short frame advertising a large even packet_len (e.g. 0x4000), so the pad-byte read lands past the end of the skb: BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14 ... net1080_rx_fixup (drivers/net/usb/net1080.c:384) usbnet_bh (drivers/net/usb/usbnet.c:1589) process_one_work (kernel/workqueue.c:3322) bh_worker (kernel/workqueue.c:3708) tasklet_action (kernel/softirq.c:965) handle_softirqs (kernel/softirq.c:622) ... Reject the frame if packet_len leaves no room for the pad byte. Valid even-length frames carry one pad byte (skb->len == packet_len + 1), so legitimate traffic is unaffected. Fixes: 904813cd8a0b ("[PATCH] USB: usbnet (4/9) module for net1080 cables") Reported-by: Weiming Shi Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei --- drivers/net/usb/net1080.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/usb/net1080.c b/drivers/net/usb/net1080.c index 5d4a1fd2b524..364c19bd822f 100644 --- a/drivers/net/usb/net1080.c +++ b/drivers/net/usb/net1080.c @@ -381,6 +381,13 @@ static int net1080_rx_fixup(struct usbnet *dev, struct sk_buff *skb) skb_trim(skb, skb->len - sizeof *trailer); if ((packet_len & 0x01) == 0) { + if (packet_len >= skb->len) { + dev->net->stats.rx_frame_errors++; + netdev_dbg(dev->net, "bad packet len %d (expected %d)\n", + skb->len, packet_len); + nc_ensure_sync(dev); + return 0; + } if (skb->data [packet_len] != PAD_BYTE) { dev->net->stats.rx_frame_errors++; netdev_dbg(dev->net, "bad pad\n"); -- 2.43.0