usb: gadget: rndis: check size of RNDIS_MSG_SET command
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 9 Feb 2022 15:37:53 +0000 (16:37 +0100)
committerPDO SCM Team <hudsoncm@motorola.com>
Wed, 4 May 2022 14:26:30 +0000 (09:26 -0500)
commit35e47904af463d54dc6359acb3ab0d41989e2f74
tree42ef062a85dde65e0e57beded022269db672ec6b
parent9008c51ab238a5ef8a46141cb09ac3f478c41703
usb: gadget: rndis: check size of RNDIS_MSG_SET command

commit 38ea1eac7d88072bbffb630e2b3db83ca649b826 upstream.

Check the size of the RNDIS_MSG_SET command given to us before
attempting to respond to an invalid message size.

Mot-CRs-fixed: (CR)
CVE-Fixed: CVE-2022-20009
Bug: 213172319

Change-Id: I9b0b3242d4ca21b48acb33241ba20eb249aa1657
Reported-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Cc: stable@kernel.org
Tested-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Gajjala Chakradhar <gajjalac@motorola.com>
Reviewed-on: https://gerrit.mot.com/2242219
SME-Granted: SME Approvals Granted
SLTApproved: Slta Waiver
Tested-by: Jira Key
Reviewed-by: Xiangpo Zhao <zhaoxp3@motorola.com>
Submit-Approved: Jira Key
drivers/usb/gadget/function/rndis.c