gb_connection_recv() verifies that the received buffer length is at least sizeof(header) and size >= msg_size but it does not check the msg_size (from header.size) which can be less than sizeof(header), that can cause an out-of-bound Read in gb_svc_request_handler().
Check msg_size < sizeof(header) before proceeding with header type.
Fixes: 564c72b1c6f7 ("greybus: operation: fix unaligned memory accesses in receive path") Reported-by: syzbot+693652ded53d3eb9cb91@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=693652ded53d3eb9cb91 Signed-off-by: Chandradhar Kumar chandradhar.2003@gmail.com --- drivers/greybus/operation.c | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/drivers/greybus/operation.c b/drivers/greybus/operation.c index 7e12ffb2dd60..9afe97731ad8 100644 --- a/drivers/greybus/operation.c +++ b/drivers/greybus/operation.c @@ -1056,6 +1056,12 @@ void gb_connection_recv(struct gb_connection *connection, return; /* XXX Should still complete operation */ }
+ if (msg_size < sizeof(header)) { + dev_err_ratelimited(dev, "%s: header size is too short\n", + connection->name); + return; + } + if (header.type & GB_MESSAGE_TYPE_RESPONSE) { gb_connection_recv_response(connection, &header, data, msg_size);