usb: gadget: function: rndis: add length check to response query

Add variable representations for BufLength and BufOffset in
rndis_query_response(), and perform a length check on them.

This is identical to how rndis_set_response() handles these parameters.

Assisted-by: gkh_clanker_2000
Cc: stable <stable@kernel.org>
Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
Link: https://patch.msgid.link/20260708-usb-gadget-rndis-v1-1-e77e026dcc6a@kroah.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c
index 3da54a7d7aba857e3e992b749d3bb3f5388a56d8..fe2018ff071a6528fdf5b9e315c09ab6e0617dfb 100644 (file)
--- a/drivers/usb/gadget/function/rndis.c
+++ b/drivers/usb/gadget/function/rndis.c
@@ -591,6 +591,7 @@ static int rndis_init_response(struct rndis_params *params,
 static int rndis_query_response(struct rndis_params *params,
                                rndis_query_msg_type *buf)
 {
+       u32 BufLength, BufOffset;
        rndis_query_cmplt_type *resp;
        rndis_resp_t *r;
 
@@ -598,6 +599,13 @@ static int rndis_query_response(struct rndis_params *params,
        if (!params->dev)
                return -ENOTSUPP;
 
+       BufLength = le32_to_cpu(buf->InformationBufferLength);
+       BufOffset = le32_to_cpu(buf->InformationBufferOffset);
+       if ((BufLength > RNDIS_MAX_TOTAL_SIZE) ||
+           (BufOffset > RNDIS_MAX_TOTAL_SIZE) ||
+           (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE))
+               return -EINVAL;
+
        /*
         * we need more memory:
         * gen_ndis_query_resp expects enough space for
@@ -614,10 +622,8 @@ static int rndis_query_response(struct rndis_params *params,
        resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
 
        if (gen_ndis_query_resp(params, le32_to_cpu(buf->OID),
-                       le32_to_cpu(buf->InformationBufferOffset)
-                                       + 8 + (u8 *)buf,
-                       le32_to_cpu(buf->InformationBufferLength),
-                       r)) {
+                               BufOffset + 8 + (u8 *)buf,
+                               BufLength, r)) {
                /* OID not supported */
                resp->Status = cpu_to_le32(RNDIS_STATUS_NOT_SUPPORTED);
                resp->MessageLength = cpu_to_le32(sizeof *resp);