[PATCH 1/2] can: esd_usb: limit the number of nets reported by the device

[Joas Antonio dos Santos via B4 Relay <devnull+joasantonio108.gmail.com@kernel.org>]

From: Joas Antonio dos Santos <joasantonio108@gmail.com>

esd_usb_probe() takes the number of CAN nets from the version reply
sent by the device and uses it unchecked as the loop bound for
esd_usb_probe_one_net(), which stores the new private data pointer in
dev->nets[index].  The nets array only has ESD_USB_MAX_NETS (2)
entries, while the device controlled u8 can be up to 255.

A device that reports more than two nets makes the driver write
pointers past the end of the array, first over the following members
of struct esd_usb and then beyond the end of the allocation.  The
loops in esd_usb_read_bulk_callback(), unlink_all_urbs() and
esd_usb_disconnect() read dev->nets[] with the same bound.

A malicious USB device can use this to corrupt kernel heap memory
just by being plugged in.

Clamp the count to the size of the array.

Found by LLM-assisted source review.

Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device")
Cc: stable@vger.kernel.org
Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
---
 drivers/net/can/usb/esd_usb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/can/usb/esd_usb.c b/drivers/net/can/usb/esd_usb.c
index f41d4a0d140f..f26a8780686f 100644
--- a/drivers/net/can/usb/esd_usb.c
+++ b/drivers/net/can/usb/esd_usb.c
@@ -1343,7 +1343,7 @@ static int esd_usb_probe(struct usb_interface *intf,
 		goto free_msg;
 	}
 
-	dev->net_count = (int)msg->version_reply.nets;
+	dev->net_count = min_t(int, msg->version_reply.nets, ESD_USB_MAX_NETS);
 	dev->version = le32_to_cpu(msg->version_reply.version);
 
 	if (device_create_file(&intf->dev, &dev_attr_firmware))

-- 
2.43.0