]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
authorKrishna Kurapati <quic_kriskura@quicinc.com>
Wed, 27 Sep 2023 10:58:58 +0000 (16:28 +0530)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 19 Oct 2023 21:05:37 +0000 (23:05 +0200)
commit7014807fb7efa169a47a7a0a0a41d2c513925de0
tree18d9f81d8474ccb84816ca25164737df8000235b
parent50259cf71a1b9542f49a050da454d07ab50b85d9
usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call

commit 427694cfaafa565a3db5c5ea71df6bc095dca92f upstream.

When NCM is used with hosts like Windows PC, it is observed that there are
multiple NTB's contained in one usb request giveback. Since the driver
unwraps the obtained request data assuming only one NTB is present, we
loose the subsequent NTB's present resulting in data loss.

Fix this by checking the parsed block length with the obtained data
length in usb request and continue parsing after the last byte of current
NTB.

Cc: stable@vger.kernel.org
Fixes: 9f6ce4240a2b ("usb: gadget: f_ncm.c added")
Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com>
Reviewed-by: Maciej Żenczykowski <maze@google.com>
Link: https://lore.kernel.org/r/20230927105858.12950-1-quic_kriskura@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/gadget/function/f_ncm.c