diff options
| author | Thomas Zimmermann <[email protected]> | 2023-01-31 14:18:33 +0100 |
|---|---|---|
| committer | Thomas Zimmermann <[email protected]> | 2023-01-31 14:18:33 +0100 |
| commit | df5bf3b942a8d344bd9cbbe6ac31c9a2ea1557a4 (patch) | |
| tree | bfbcbe56b9f4f8b1e44242b80800a68b2ae5b2d6 /drivers/net/usb/rndis_host.c | |
| parent | 532a38292c7213aa6d950e6a1b86659d08b5aa67 (diff) | |
| parent | aebd8f0c6f8280ba35bc989f4a9ea47469d3589a (diff) | |
Merge drm/drm-next into drm-misc-next
Backmerging to get v6.2-rc6.
Signed-off-by: Thomas Zimmermann <[email protected]>
Diffstat (limited to 'drivers/net/usb/rndis_host.c')
| -rw-r--r-- | drivers/net/usb/rndis_host.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c index f79333fe1783..7b3739b29c8f 100644 --- a/drivers/net/usb/rndis_host.c +++ b/drivers/net/usb/rndis_host.c @@ -255,7 +255,8 @@ static int rndis_query(struct usbnet *dev, struct usb_interface *intf, off = le32_to_cpu(u.get_c->offset); len = le32_to_cpu(u.get_c->len); - if (unlikely((8 + off + len) > CONTROL_BUFFER_SIZE)) + if (unlikely((off > CONTROL_BUFFER_SIZE - 8) || + (len > CONTROL_BUFFER_SIZE - 8 - off))) goto response_error; if (*reply_len != -1 && len != *reply_len) |