diff options
| author |   Michel Pollet <michel.pollet@bp.renesas.com> | 2018-05-10 14:09:09 +0100 |
|---|---|---|
| committer |   Felipe Balbi <felipe.balbi@linux.intel.com> | 2018-05-15 10:24:28 +0300 |
| commit | 1ca532e9916a277b0e87271e6b367a3774808035 (patch) | |
| tree | 844261bdb0df24de8ea129daef6a4cb89425cb2d /drivers/usb/gadget | |
| parent | usb: dwc3: use local copy of resource to fix-up register offset (diff) | |
| download | linux-dev-1ca532e9916a277b0e87271e6b367a3774808035.tar.xz linux-dev-1ca532e9916a277b0e87271e6b367a3774808035.zip | |
USB: rndis: Fix for handling garbled messages
A message can be forged to crash the stack; here we make sure we don't
completely break the system if this occurs
Signed-off-by: Michel Pollet <michel.pollet@bp.renesas.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Diffstat (limited to 'drivers/usb/gadget')
| -rw-r--r-- | drivers/usb/gadget/function/rndis.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c index 51dd3e90b06c..04c142c13075 100644 --- a/drivers/usb/gadget/function/rndis.c +++ b/drivers/usb/gadget/function/rndis.c @@ -851,6 +851,9 @@ int rndis_msg_parser(struct rndis_params *params, u8 *buf) */ pr_warn("%s: unknown RNDIS message 0x%08X len %d\n", __func__, MsgType, MsgLength); + /* Garbled message can be huge, so limit what we display */ + if (MsgLength > 16) + MsgLength = 16; print_hex_dump_bytes(__func__, DUMP_PREFIX_OFFSET, buf, MsgLength); break; |