diff options
| author | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2022-05-27 15:48:45 -0700 |
|---|---|---|
| committer | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2022-05-27 15:48:45 -0700 |
| commit | 1e90e2628cec11c080db3260833f515cc32fc27c (patch) | |
| tree | a50cb16a2046266e39a60bc554782e667edd31c4 /drivers/usb/gadget/function/rndis.c | |
| parent | b26ff9137183309c18cdfe931e1cafcf3c1a980d (diff) | |
| parent | 5f76955ab1e43e5795a9631b22ca4f918a0ae986 (diff) | |
Merge branch 'next' into for-linus
Prepare input updates for 5.19 merge window.
Diffstat (limited to 'drivers/usb/gadget/function/rndis.c')
| -rw-r--r-- | drivers/usb/gadget/function/rndis.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c index 00b3f6b3bb31..713efd9aefde 100644 --- a/drivers/usb/gadget/function/rndis.c +++ b/drivers/usb/gadget/function/rndis.c @@ -640,6 +640,7 @@ static int rndis_set_response(struct rndis_params *params, BufLength = le32_to_cpu(buf->InformationBufferLength); BufOffset = le32_to_cpu(buf->InformationBufferOffset); if ((BufLength > RNDIS_MAX_TOTAL_SIZE) || + (BufOffset > RNDIS_MAX_TOTAL_SIZE) || (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE)) return -EINVAL; |