diff options
| author | Aamir Ahmed <elb12345@hotmail.co.uk> | 2026-09-07 02:42:34 +0000 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2026-09-10 12:37:09 +0200 |
| commit | 5d4d985957434867bbe85e4fa5e638f3e48ad522 (patch) | |
| tree | bcddb5736265d2d16cd1d1341b0b01571dddbbff /scripts/basic/split-include.c | |
| parent | af406abfecad2f48d8f1fc646d3994f0982bac62 (diff) | |
| download | linux-5d4d985957434867bbe85e4fa5e638f3e48ad522.tar.gz linux-5d4d985957434867bbe85e4fa5e638f3e48ad522.zip | |
net: hinic: fix mailbox segment buffer overflow
check_mbox_seq_id_and_seg_len() validates that seq_id does not
exceed SEQ_ID_MAX_VAL (42) and seg_len does not exceed
MBOX_SEG_LEN (48). However, this allows the last segment
(seq_id=42) to carry a full 48-byte payload, writing to offset
42*48=2016 for 48 bytes (ending at byte 2064). The receive
buffer is only MBOX_MAX_BUF_SZ (2048) bytes, resulting in a
16-byte heap buffer overflow.
The hinic3 driver already handles this correctly by defining
MBOX_LAST_SEG_MAX_LEN and rejecting the last segment when it
exceeds the remaining buffer space. Apply the same fix to the
hinic driver.
Fixes: a425b6e1c69b ("hinic: add mailbox function support")
Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
Link: https://patch.msgid.link/AS8P251MB0001AE870B09020B46B5D7DBC8B22@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Diffstat (limited to 'scripts/basic/split-include.c')
0 files changed, 0 insertions, 0 deletions