Skip to content

[ciqcbr7_9] Multiple patches tested (2 commits) #1344

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
roxanan1996 merged 2 commits into from
Jun 16, 2026
Merged

[ciqcbr7_9] Multiple patches tested (2 commits) #1344

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9570c08
usbip: validate number_of_packets in usbip_pack_ret_submit()
Jun 15, 2026
f0c2cea
netfilter: ip6t_eui64: reject invalid MAC header for all packets
Jun 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions drivers/usb/usbip/usbip_common.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -400,6 +400,18 @@ static void usbip_pack_ret_submit(struct usbip_header *pdu, struct urb *urb,
urb->status = rpdu->status;
urb->actual_length = rpdu->actual_length;
urb->start_frame = rpdu->start_frame;
/*
* The number_of_packets field determines the length of
* iso_frame_desc[], which is a flexible array allocated
* at URB creation time. A response must never claim more
* packets than originally submitted; doing so would cause
* an out-of-bounds write in usbip_recv_iso() and
* usbip_pad_iso(). Clamp to zero on violation so both
* functions safely return early.
*/
if (rpdu->number_of_packets < 0 ||
rpdu->number_of_packets > urb->number_of_packets)
rpdu->number_of_packets = 0;
urb->number_of_packets = rpdu->number_of_packets;
urb->error_count = rpdu->error_count;
}
Expand Down
3 changes: 1 addition & 2 deletions net/ipv6/netfilter/ip6t_eui64.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,8 +25,7 @@ eui64_mt6(const struct sk_buff *skb, struct xt_action_param *par)
unsigned char eui64[8];

if (!(skb_mac_header(skb) >= skb->head &&
skb_mac_header(skb) + ETH_HLEN <= skb->data) &&
par->fragoff != 0) {
skb_mac_header(skb) + ETH_HLEN <= skb->data)) {
par->hotdrop = true;
return false;
}
Expand Down