usb: gadget: rndis: check size of RNDIS_MSG_SET command
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 9 Feb 2022 15:37:53 +0000 (16:37 +0100)
committerSalvatore Bonaccorso <carnil@debian.org>
Mon, 28 Feb 2022 11:23:03 +0000 (11:23 +0000)
commitc8135ecf1f1874744994cce0be329937ef8a5592
tree7639826f718c2212ff9d1b6a1ea667ee4f801b97
parentee42b547447016df5a8a821c4742528988681e9a
usb: gadget: rndis: check size of RNDIS_MSG_SET command

Origin: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit?id=fb4ff0f96de37c44236598e8b53fe43b1df36bf3
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2022-25375

commit 38ea1eac7d88072bbffb630e2b3db83ca649b826 upstream.

Check the size of the RNDIS_MSG_SET command given to us before
attempting to respond to an invalid message size.

Reported-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Cc: stable@kernel.org
Tested-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Gbp-Pq: Topic bugfix/all
Gbp-Pq: Name usb-gadget-rndis-check-size-of-RNDIS_MSG_SET-command.patch
drivers/usb/gadget/function/rndis.c