usb: gadget: function: rndis: add length check for header

Add a length check for the rndis header in rndis_rm_hdr, to ensure that
MessageType, MessageLength, DataOffset, and DataLength fields are
present before they are accessed.

Assisted-by: gkh_clanker_2000
Cc: stable <stable@kernel.org>
Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
Link: https://patch.msgid.link/20260708-usb-gadget-rndis-v1-2-e77e026dcc6a@kroah.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c
index fe2018ff071a6528fdf5b9e315c09ab6e0617dfb..a2fd239b7ad3331958dbccbdfec090c7fac8236f 100644 (file)
--- a/drivers/usb/gadget/function/rndis.c
+++ b/drivers/usb/gadget/function/rndis.c
@@ -1080,6 +1080,12 @@ int rndis_rm_hdr(struct gether *port,
        /* tmp points to a struct rndis_packet_msg_type */
        __le32 *tmp = (void *)skb->data;
 
+       /* Need at least MessageType, MessageLength, DataOffset, DataLength */
+       if (skb->len < 16) {
+               dev_kfree_skb_any(skb);
+               return -EINVAL;
+       }
+
        /* MessageType, MessageLength */
        if (cpu_to_le32(RNDIS_MSG_PACKET)
                        != get_unaligned(tmp++)) {