CVE-2023-53667: net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize

In the Linux kernel, the following vulnerability has been resolved:

net: cdcncm: Deal with too low values of dwNtbOutMaxSize

Currently in cdcncmchecktxmax(), if dwNtbOutMaxSize is lower than the calculated "min" value, but greater than zero, the logic sets txmax to dwNtbOutMaxSize. This is then used to allocate a new SKB in cdcncmfilltxframe() where all the data is handled.

For small values of dwNtbOutMaxSize the memory allocated during allocskb(dwNtbOutMaxSize, GFPATOMIC) will have the same size, due to how size is aligned at alloc time: size = SKBDATAALIGN(size); size += SKBDATAALIGN(sizeof(struct skbsharedinfo)); Thus we hit the same bug that we tried to squash with commit 2be6d4d16a084 ("net: cdcncm: Allow for dwNtbOutMaxSize to be unset or zero")

Low values of dwNtbOutMaxSize do not cause an issue presently because at allocskb() time more memory (512b) is allocated than required for the SKB headers alone (320b), leaving some space (512b - 320b = 192b) for CDC data (172b).

However, if more elements (for example 3 x u64 = [24b]) were added to one of the SKB header structs, say 'struct skbsharedinfo', increasing its original size (320b [320b aligned]) to something larger (344b [384b aligned]), then suddenly the CDC data (172b) no longer fits in the spare SKB data area (512b - 384b = 128b).

Consequently the SKB bounds checking semantics fails and panics:

skbuff: skboverpanic: text:ffffffff831f755b len:184 put:172 head:ffff88811f1c6c00 data:ffff88811f1c6c00 tail:0xb8 end:0x80 dev:<NULL> ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:113! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 57 Comm: kworker/0:2 Not tainted 5.15.106-syzkaller-00249-g19c0ed55a470 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 Workqueue: mld mldifcwork RIP: 0010:skbpanic net/core/skbuff.c:113 [inline] RIP: 0010:skboverpanic+0x14c/0x150 net/core/skbuff.c:118 [snip] Call Trace: <TASK> skbput+0x151/0x210 net/core/skbuff.c:2047 skbputzero include/linux/skbuff.h:2422 [inline] cdcncmndp16 drivers/net/usb/cdcncm.c:1131 [inline] cdcncmfilltxframe+0x11ab/0x3da0 drivers/net/usb/cdcncm.c:1308 cdcncmtxfixup+0xa3/0x100

Deal with too low values of dwNtbOutMaxSize, clamp it in the range [USBCDCNCMNTBMINOUTSIZE, CDCNCMNTBMAXSIZETX]. We ensure enough data space is allocated to handle CDC data by making sure dwNtbOutMaxSize is not smaller than USBCDCNCMNTBMINOUTSIZE.