[PATCH] greybus: operation: fix OOB Read in gb_svc_request_handler

[PATCH] greybus: operation: fix OOB Read in gb_svc_request_handler

[Chandradhar Kumar]

gb_connection_recv() verifies that the received buffer length is at
least sizeof(header) and size >= msg_size but it does not check the
msg_size (from header.size) which can be less than sizeof(header),
that can cause an out-of-bound Read in gb_svc_request_handler().

Check msg_size < sizeof(header) before proceeding with header type.

Fixes: 564c72b1c6f7 ("greybus: operation: fix unaligned memory accesses in receive path")
Reported-by: syzbot+693652ded53d3eb9cb91@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=693652ded53d3eb9cb91
Signed-off-by: Chandradhar Kumar <chandradhar.2003@gmail.com>
---
 drivers/greybus/operation.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/greybus/operation.c b/drivers/greybus/operation.c
index 7e12ffb2dd60..9afe97731ad8 100644
--- a/drivers/greybus/operation.c
+++ b/drivers/greybus/operation.c
@@ -1056,6 +1056,12 @@ void gb_connection_recv(struct gb_connection *connection,
 		return;		/* XXX Should still complete operation */
 	}
 
+	if (msg_size < sizeof(header)) {
+		dev_err_ratelimited(dev, "%s: header size is too short\n",
+				    connection->name);
+		return;
+	}
+
 	if (header.type & GB_MESSAGE_TYPE_RESPONSE) {
 		gb_connection_recv_response(connection,	&header, data,
 					    msg_size);
-- 
2.56.0