The "data_offset" and "data_len" values come from received skb->data so we don't trust them. They are u32 types. Check that the "data_offset + data_len + 8" addition does not have an integer overflow. Fixes: 64e049102d3d ("[PATCH] USB: usbnet (8/9) module for RNDIS devices") Signed-off-by: Dan Carpenter --- drivers/net/usb/rndis_host.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c index 7b3739b29c8f..913aca6ff434 100644 --- a/drivers/net/usb/rndis_host.c +++ b/drivers/net/usb/rndis_host.c @@ -513,8 +513,9 @@ int rndis_rx_fixup(struct usbnet *dev, struct sk_buff *skb) data_len = le32_to_cpu(hdr->data_len); /* don't choke if we see oob, per-packet data, etc */ - if (unlikely(msg_type != RNDIS_MSG_PACKET || skb->len < msg_len - || (data_offset + data_len + 8) > msg_len)) { + if (unlikely(msg_type != RNDIS_MSG_PACKET || skb->len < msg_len || + size_add(data_offset, data_len) > U32_MAX - 8 || + (data_offset + data_len + 8) > msg_len)) { dev->net->stats.rx_frame_errors++; netdev_dbg(dev->net, "bad rndis message %d/%d/%d/%d, len %d\n", le32_to_cpu(hdr->msg_type), -- 2.51.0